docs: note the stop guard order, background polls, clone skip and trap order

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build-app-preview.yml

@@ -66,7 +66,13 @@ env:
   # libraries" prompt and hangs the job until it times out. `sudo` resets the
   # environment, so the apt-get calls below also pass these via `sudo env`;
   # here they reach the NodeSource setup script through `sudo -E`.
-  NEEDRESTART_MODE: a
+  #
+  # SUSPEND skips needrestart entirely. Mode `a` (restart automatically) is not
+  # safe: on a host-mode runner it restarted act-runner.service mid-job and
+  # killed the job. Mode `l` (list only) is a fallback for a needrestart that
+  # ignores SUSPEND; it never prompts and never restarts anything.
+  NEEDRESTART_SUSPEND: "1"
+  NEEDRESTART_MODE: l
   DEBIAN_FRONTEND: noninteractive
   GITEA_URL: ${{ gitea.server_url }}
   REPO: ${{ gitea.repository }}
@@ -84,6 +90,9 @@ on:
       - "app/**"
       - "VERSION"
       - ".gitea/workflows/build-app-preview.yml"
+      # The app embeds the agent's sources for its local image build, and the
+      # agent's own tests run in the `test` job below.
+      - "container/triple-c-agent/**"
   workflow_dispatch:
 
 jobs:
@@ -269,7 +278,7 @@ jobs:
           fi
           if [ "$NEED_INSTALL" = true ]; then
             curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
-            sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
+            sudo env NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=l DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
             hash -r
           fi
           node --version
@@ -280,8 +289,8 @@ jobs:
 
       - name: Install system dependencies
         run: |
-          sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get update
-          sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get install -y \
+          sudo env NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=l DEBIAN_FRONTEND=noninteractive apt-get update
+          sudo env NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=l DEBIAN_FRONTEND=noninteractive apt-get install -y \
             libgtk-3-dev \
             libwebkit2gtk-4.1-dev \
             gstreamer1.0-plugins-base \
@@ -332,6 +341,16 @@ jobs:
           export PATH="$HOME/.cargo/bin:$PATH"
           cargo test --locked
 
+      # The in-container agent is its own crate (container/triple-c-agent): a
+      # real server on loopback, exercised over HTTP/WebSocket as the current
+      # user. Its root-only test is #[ignore]d. The Docker-parity test against
+      # a real container lives in the app (host::agent::live_tests, ignored).
+      - name: Agent tests (cargo test)
+        working-directory: ./container/triple-c-agent
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          cargo test --locked
+
   build-linux:
     runs-on: ubuntu-latest
     needs: [compute-version, create-release]
@@ -355,7 +374,7 @@ jobs:
           fi
           if [ "$NEED_INSTALL" = true ]; then
             curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
-            sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
+            sudo env NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=l DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
             hash -r
           fi
           node --version
@@ -378,8 +397,8 @@ jobs:
 
       - name: Install system dependencies
         run: |
-          sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get update
-          sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get install -y \
+          sudo env NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=l DEBIAN_FRONTEND=noninteractive apt-get update
+          sudo env NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=l DEBIAN_FRONTEND=noninteractive apt-get install -y \
             libgtk-3-dev \
             libwebkit2gtk-4.1-dev \
             gstreamer1.0-plugins-base \

.gitea/workflows/build-app.yml

@@ -1,20 +1,22 @@
 name: Build App
 
+# **Releases are cut by hand.** This runs only when someone dispatches it
+# (Actions -> Build App -> Run workflow). Merging to main does not release:
+# main can carry finished-but-dormant work (a feature landing in phases) and
+# nothing reaches users until a release is cut on purpose.
+#
+# Dispatched on `main` it releases: Gitea and GitHub releases, the version tag,
+# the Linux update channel, and then the container images' `:latest` (see the
+# create-tag job). Dispatched on any other branch it is a dry run that builds,
+# signs and verifies all three platforms and publishes nothing, which is how to
+# exercise Windows signing before a merge. Every publishing step and job
+# carries the same `if:` (dispatch event *and* ref main); keep them in step if
+# one is ever added.
 on:
-  push:
-    branches: [main]
-    paths:
-      - "app/**"
-      - "VERSION"
-      - ".gitea/workflows/build-app.yml"
-      - "scripts/windows-*.ps1"
   workflow_dispatch:
 
-# Deliberately **not** on pull_request. Every publishing step here is gated on
-# `gitea.event_name == 'push'`, so a PR run compiled all three platforms and
-# produced nothing — and it ran alongside build-app-preview.yml, which compiles
-# the same three and publishes them. Six OS builds per push, one set of which
-# was unreachable. Previews now carry the PR check; this workflow is releases.
+# Deliberately **not** on pull_request: build-app-preview.yml carries the PR
+# check (tests plus all three platforms), and this workflow is releases only.
 
 env:
   # The ephemeral Proxmox runners (eph-pve3-*) ship needrestart, which after
@@ -22,7 +24,13 @@ env:
   # libraries" prompt and hangs the job until it times out. `sudo` resets the
   # environment, so the apt-get calls below also pass these via `sudo env`;
   # here they reach the NodeSource setup script through `sudo -E`.
-  NEEDRESTART_MODE: a
+  #
+  # SUSPEND skips needrestart entirely. Mode `a` (restart automatically) is not
+  # safe: on a host-mode runner it restarted act-runner.service mid-job and
+  # killed the job. Mode `l` (list only) is a fallback for a needrestart that
+  # ignores SUSPEND; it never prompts and never restarts anything.
+  NEEDRESTART_SUSPEND: "1"
+  NEEDRESTART_MODE: l
   DEBIAN_FRONTEND: noninteractive
   GITEA_URL: ${{ gitea.server_url }}
   REPO: ${{ gitea.repository }}
@@ -125,7 +133,7 @@ jobs:
           fi
           if [ "$NEED_INSTALL" = true ]; then
             curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
-            sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
+            sudo env NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=l DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
             hash -r
           fi
           echo "Node.js at: $(which node)"
@@ -147,8 +155,8 @@ jobs:
 
       - name: Install system dependencies
         run: |
-          sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get update
-          sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get install -y \
+          sudo env NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=l DEBIAN_FRONTEND=noninteractive apt-get update
+          sudo env NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=l DEBIAN_FRONTEND=noninteractive apt-get install -y \
             libgtk-3-dev \
             libwebkit2gtk-4.1-dev \
             gstreamer1.0-plugins-base \
@@ -256,7 +264,7 @@ jobs:
           fi
 
       - name: Upload to Gitea release
-        if: gitea.event_name == 'push'
+        if: gitea.event_name == 'workflow_dispatch' && gitea.ref == 'refs/heads/main'
         env:
           TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
@@ -282,7 +290,7 @@ jobs:
               curl -fsS -X POST \
                 -H "Authorization: token ${TOKEN}" \
                 -H "Content-Type: application/json" \
-                -d "{\"tag_name\": \"${TAG}\", \"name\": \"Triple-C ${TAG} (Linux)\", \"body\": \"Automated build from commit ${{ gitea.sha }}\"}" \
+                -d "{\"tag_name\": \"${TAG}\", \"target_commitish\": \"${{ gitea.sha }}\", \"name\": \"Triple-C ${TAG} (Linux)\", \"body\": \"Automated build from commit ${{ gitea.sha }}\"}" \
                 "${GITEA_URL}/api/v1/repos/${REPO}/releases" > release.json
               ;;
             *)
@@ -334,7 +342,7 @@ jobs:
       # from the versioned release above because the updater's URL must never
       # move, and `releases/latest` does.
       - name: Publish the Linux update channel
-        if: gitea.event_name == 'push'
+        if: gitea.event_name == 'workflow_dispatch' && gitea.ref == 'refs/heads/main'
         env:
           GH_PAT: ${{ secrets.GH_PAT }}
           GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
@@ -423,7 +431,7 @@ jobs:
           ls -la artifacts/
 
       - name: Upload to Gitea release
-        if: gitea.event_name == 'push'
+        if: gitea.event_name == 'workflow_dispatch' && gitea.ref == 'refs/heads/main'
         env:
           TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
@@ -449,7 +457,7 @@ jobs:
               curl -fsS -X POST \
                 -H "Authorization: token ${TOKEN}" \
                 -H "Content-Type: application/json" \
-                -d "{\"tag_name\": \"${TAG}\", \"name\": \"Triple-C v${{ needs.compute-version.outputs.version }} (macOS)\", \"body\": \"Automated build from commit ${{ gitea.sha }}\"}" \
+                -d "{\"tag_name\": \"${TAG}\", \"target_commitish\": \"${{ gitea.sha }}\", \"name\": \"Triple-C v${{ needs.compute-version.outputs.version }} (macOS)\", \"body\": \"Automated build from commit ${{ gitea.sha }}\"}" \
                 "${GITEA_URL}/api/v1/repos/${REPO}/releases" > release.json
               ;;
             *)
@@ -711,7 +719,7 @@ jobs:
           dir artifacts\
 
       - name: Upload to Gitea release
-        if: gitea.event_name == 'push'
+        if: gitea.event_name == 'workflow_dispatch' && gitea.ref == 'refs/heads/main'
         shell: powershell
         env:
           TOKEN: ${{ secrets.REGISTRY_TOKEN }}
@@ -735,8 +743,9 @@ jobs:
             if ($_.Exception.Response.StatusCode.value__ -eq 404) {
               Write-Host "Release $tag not found, creating"
               $body = @{
-                tag_name = $tag
-                name     = "Triple-C v$env:VERSION (Windows)"
+                tag_name         = $tag
+                target_commitish = $env:COMMIT_SHA
+                name             = "Triple-C v$env:VERSION (Windows)"
                 body     = "Automated build from commit $env:COMMIT_SHA"
               } | ConvertTo-Json
               $release = Invoke-RestMethod -Method Post -Headers $headers `
@@ -772,7 +781,7 @@ jobs:
   create-tag:
     runs-on: ubuntu-latest
     needs: [compute-version, build-linux, build-macos, build-windows]
-    if: gitea.event_name == 'push'
+    if: gitea.event_name == 'workflow_dispatch' && gitea.ref == 'refs/heads/main'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -782,24 +791,56 @@ jobs:
       - name: Create version tag
         env:
           TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          VERSION: ${{ needs.compute-version.outputs.version }}
+          SHA: ${{ gitea.sha }}
         run: |
-          VERSION="${{ needs.compute-version.outputs.version }}"
+          set -euo pipefail
           TAG="v${VERSION}"
-          echo "Creating tag ${TAG}..."
 
-          # Create annotated tag via Gitea API
-          curl -s -X POST \
-            -H "Authorization: token ${TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "{\"tag_name\": \"${TAG}\", \"target\": \"${{ gitea.sha }}\", \"message\": \"Release ${TAG}\"}" \
-            "${GITEA_URL}/api/v1/repos/${REPO}/tags" || echo "Tag may already exist (created by release)"
+          # Usually already there: creating the Linux release creates its tag,
+          # at this commit (`target_commitish`). Create it if not, then insist
+          # it points here, because the container step below builds whatever
+          # the tag names.
+          if ! curl -fsS -o tag.json -H "Authorization: token ${TOKEN}" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/tags/${TAG}"; then
+            echo "Creating tag ${TAG} at ${SHA}"
+            curl -fsS -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "{\"tag_name\": \"${TAG}\", \"target\": \"${SHA}\", \"message\": \"Release ${TAG}\"}" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/tags" > tag.json
+          fi
+          TAGGED=$(python3 -c "import json; print(json.load(open('tag.json'))['commit']['sha'])")
+          if [ "${TAGGED}" != "${SHA}" ]; then
+            echo "Tag ${TAG} points at ${TAGGED}, not the released commit ${SHA}" >&2
+            exit 1
+          fi
+          echo "Tag ${TAG} is at ${SHA}"
 
-          echo "Tag ${TAG} created successfully"
+      # The containers' `:latest` is what every installed app pulls, so it
+      # moves with an app release and at no other time (pushes to main only
+      # publish `:edge` and `:<sha>`). Each container workflow builds the tag
+      # it is handed, not main, so a merge landing mid-release cannot ride
+      # along.
+      - name: Release the container images
+        env:
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          VERSION: ${{ needs.compute-version.outputs.version }}
+        run: |
+          set -euo pipefail
+          for WORKFLOW in build.yml build-stt.yml; do
+            echo "Dispatching ${WORKFLOW} for v${VERSION}"
+            curl -fsS -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "{\"ref\": \"main\", \"inputs\": {\"release_tag\": \"v${VERSION}\"}}" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/actions/workflows/${WORKFLOW}/dispatches"
+          done
 
   sync-to-github:
     runs-on: ubuntu-latest
     needs: [compute-version, build-linux, build-macos, build-windows]
-    if: gitea.event_name == 'push'
+    if: gitea.event_name == 'workflow_dispatch' && gitea.ref == 'refs/heads/main'
     env:
       GH_PAT: ${{ secrets.GH_PAT }}
       GITHUB_REPO: shadowdao/triple-c

.gitea/workflows/build-stt.yml

@@ -11,6 +11,12 @@ on:
     paths:
       - "stt-container/**"
       - ".gitea/workflows/build-stt.yml"
+  # Dispatched by build-app.yml when a release is cut, with the release's tag.
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: "Release tag to build as :latest (default: the newest vX.Y.Z)"
+        required: false
 
 env:
   REGISTRY: repo.anhonesthost.net
@@ -22,6 +28,65 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # **`:latest` is what installed apps pull, so only a release moves it.**
+      # A push to main publishes `:edge` and `:<sha>` (for testing a merged
+      # image by hand); a pull request publishes nothing. The weekly rebuild
+      # and a release dispatch build a release tag and publish it as `:latest`
+      # — the tag, not main, so unreleased container changes never reach users.
+      - name: Pick the source and the tags to publish
+        id: src
+        env:
+          EVENT: ${{ gitea.event_name }}
+          RELEASE_TAG: ${{ gitea.event.inputs.release_tag }}
+          REF: ${{ gitea.ref }}
+        run: |
+          set -euo pipefail
+          case "$EVENT" in
+            push|pull_request)
+              CHANNEL=edge
+              ;;
+            schedule|workflow_dispatch)
+              CHANNEL=latest
+              # `:latest` reaches every user, so it only comes from main: a
+              # dispatch from another branch, or a tag cut on one, is refused.
+              # An older release tag is allowed on purpose — that is a rollback.
+              if [ "$REF" != "refs/heads/main" ]; then
+                echo "Refusing to publish :latest from $REF (only main)" >&2
+                exit 1
+              fi
+              git fetch --tags --force
+              git fetch origin main
+              if [ -z "${RELEASE_TAG:-}" ]; then
+                RELEASE_TAG=$(git tag -l 'v*' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -1)
+              fi
+              if ! echo "$RELEASE_TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+                echo "Not a release tag: '$RELEASE_TAG'" >&2
+                exit 1
+              fi
+              if ! git merge-base --is-ancestor "refs/tags/$RELEASE_TAG" FETCH_HEAD; then
+                echo "$RELEASE_TAG is not on main; refusing to publish it as :latest" >&2
+                exit 1
+              fi
+              git checkout --detach "refs/tags/$RELEASE_TAG"
+              echo "Building release $RELEASE_TAG"
+              ;;
+            *)
+              echo "Unexpected event $EVENT" >&2
+              exit 1
+              ;;
+          esac
+          SHA=$(git rev-parse HEAD)
+          {
+            echo "tags<<EOF"
+            echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$CHANNEL"
+            echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$SHA"
+            echo "ghcr.io/shadowdao/triple-c-stt:$CHANNEL"
+            echo "ghcr.io/shadowdao/triple-c-stt:$SHA"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -49,12 +114,10 @@ jobs:
           context: ./stt-container
           file: ./stt-container/Dockerfile
           platforms: linux/amd64,linux/arm64
-          push: ${{ gitea.event_name == 'push' }}
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ gitea.sha }}
-            ghcr.io/shadowdao/triple-c-stt:latest
-            ghcr.io/shadowdao/triple-c-stt:${{ gitea.sha }}
+          # A pull_request run only validates; see the tag step for what each
+          # other event publishes.
+          push: ${{ gitea.event_name != 'pull_request' }}
+          tags: ${{ steps.src.outputs.tags }}
           # The gha cache is served by the runner that picks the job up, and
           # is unreachable from the job on some of ours (the home box's
           # firewalled per-job bridge; ephemeral runners). Import failures

.gitea/workflows/build.yml

@@ -13,9 +13,15 @@ on:
       - ".gitea/workflows/build.yml"
   # Weekly rebuild with no commit needed, so OS security fixes published since
   # the last push reach the image (see APT_REFRESH in container/Dockerfile).
-  # Scheduled runs use the default branch, i.e. main.
+  # It rebuilds the newest *release*, not main, because it moves `:latest`.
   schedule:
     - cron: "17 4 * * 1"
+  # Dispatched by build-app.yml when a release is cut, with the release's tag.
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: "Release tag to build as :latest (default: the newest vX.Y.Z)"
+        required: false
 
 env:
   REGISTRY: repo.anhonesthost.net
@@ -27,6 +33,65 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # **`:latest` is what installed apps pull, so only a release moves it.**
+      # A push to main publishes `:edge` and `:<sha>` (for testing a merged
+      # image by hand); a pull request publishes nothing. The weekly rebuild
+      # and a release dispatch build a release tag and publish it as `:latest`
+      # — the tag, not main, so unreleased container changes never reach users.
+      - name: Pick the source and the tags to publish
+        id: src
+        env:
+          EVENT: ${{ gitea.event_name }}
+          RELEASE_TAG: ${{ gitea.event.inputs.release_tag }}
+          REF: ${{ gitea.ref }}
+        run: |
+          set -euo pipefail
+          case "$EVENT" in
+            push|pull_request)
+              CHANNEL=edge
+              ;;
+            schedule|workflow_dispatch)
+              CHANNEL=latest
+              # `:latest` reaches every user, so it only comes from main: a
+              # dispatch from another branch, or a tag cut on one, is refused.
+              # An older release tag is allowed on purpose — that is a rollback.
+              if [ "$REF" != "refs/heads/main" ]; then
+                echo "Refusing to publish :latest from $REF (only main)" >&2
+                exit 1
+              fi
+              git fetch --tags --force
+              git fetch origin main
+              if [ -z "${RELEASE_TAG:-}" ]; then
+                RELEASE_TAG=$(git tag -l 'v*' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -1)
+              fi
+              if ! echo "$RELEASE_TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+                echo "Not a release tag: '$RELEASE_TAG'" >&2
+                exit 1
+              fi
+              if ! git merge-base --is-ancestor "refs/tags/$RELEASE_TAG" FETCH_HEAD; then
+                echo "$RELEASE_TAG is not on main; refusing to publish it as :latest" >&2
+                exit 1
+              fi
+              git checkout --detach "refs/tags/$RELEASE_TAG"
+              echo "Building release $RELEASE_TAG"
+              ;;
+            *)
+              echo "Unexpected event $EVENT" >&2
+              exit 1
+              ;;
+          esac
+          SHA=$(git rev-parse HEAD)
+          {
+            echo "tags<<EOF"
+            echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$CHANNEL"
+            echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$SHA"
+            echo "ghcr.io/shadowdao/triple-c-sandbox:$CHANNEL"
+            echo "ghcr.io/shadowdao/triple-c-sandbox:$SHA"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -81,16 +146,12 @@ jobs:
           context: ./container
           file: ./container/Dockerfile
           platforms: linux/amd64,linux/arm64
-          # Publish from main pushes and the weekly scheduled rebuild (which
-          # runs on main); a pull_request run only validates.
+          # A pull_request run only validates; see the tag step for what each
+          # other event publishes.
           push: ${{ gitea.event_name != 'pull_request' }}
           build-args: |
             APT_REFRESH=${{ steps.apt.outputs.stamp }}
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ gitea.sha }}
-            ghcr.io/shadowdao/triple-c-sandbox:latest
-            ghcr.io/shadowdao/triple-c-sandbox:${{ gitea.sha }}
+          tags: ${{ steps.src.outputs.tags }}
           # `ignore-error` is what stops a cache failure failing a build that
           # already succeeded. act_runner emulates the GitHub Actions cache
           # service on the runner host's LAN address, and the `docker-container`

.gitignore

@@ -1,6 +1,7 @@
 node_modules/
 app/dist/
 app/src-tauri/target/
+container/triple-c-agent/target/
 # Written by build.rs (tauri-build AppManifest); gen/schemas/acl-manifests.json is the
 # tracked, reviewable form of the same information.
 app/src-tauri/permissions/autogenerated/
@@ -19,3 +20,10 @@ screenshot_for_fix/
 
 # Windows CI code signing (scripts/windows-signing-setup.ps1)
 .code-signing/
+
+# OpenTofu working state (aws/terraform/*): providers, local state, locks.
+# The modules' .terraform.lock.hcl files are committed.
+.terraform/
+*.tfstate
+*.tfstate.*
+.terraform.tfstate.lock.info

CLAUDE.md

@@ -264,8 +264,8 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
 - **`docker/`** — Docker API layer using bollard:
   - `client.rs` — Singleton Docker connection via `OnceLock`
   - `container.rs` — Container lifecycle (create, start, stop, remove, inspect)
-  - `exec.rs` — Attached exec streaming. `create_attached_exec()` is the **single** place an
-    attached exec is opened; terminal sessions and the auth bridge both go through it.
+  - `exec.rs` — Docker's implementation of everything `host::ContainerTarget` does inside a
+    container. `create_attached_exec_spec()` is the **single** place an attached exec is opened.
   - `image.rs` — Image build/pull with progress streaming
   - `gateway.rs` — Optional LiteLLM sibling container giving Claude Code an Anthropic-format
     front end for providers that only speak OpenAI (see `gateway-container/`). Mirrors `stt.rs`.
@@ -282,6 +282,101 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
   - `legacy_cleanup.rs` — One-release migration shim removing leftovers from the deleted MCP
     feature (containers labelled `triple-c.mcp-server`, `triple-c-net-*` networks). Deletable once
     users have migrated.
+- **`host/`** — Where a project's container runs, and the only way into it. `ContainerTarget`
+  (`Docker`, and `Agent` — reached through the in-container `triple-c-agent` by `agent.rs`, per
+  `docs/superpowers/specs/2026-11-13-triple-c-agent-protocol.md`; AWS planned —
+  `docs/superpowers/specs/2026-11-13-aws-ecs-host-design.md`)
+  wraps execs, file transfer and `is_running`; `sessions.rs` holds `ExecSessionManager`.
+  `ssm.rs` is the AWS transport to an `Agent` target: one SSM port-forward per task, run through
+  AWS's `session-manager-plugin` as a child process and reopened **on the same loopback port**
+  when it drops, so an `AgentEndpoint` stays valid. The `StartSession` token goes to the plugin
+  through its environment, never argv, and the plugin's environment is stripped of every
+  inherited `AWS_*` variable before the session's own credentials are added.
+  `aws_host.rs` is `ProjectHost::Aws` (an ECS Fargate task per project; a running task is
+  attached to with the token read back from its secret, never rotated; a task a failed start ran
+  is stopped again) and `tunnels.rs` the registry of open tunnels by project — an AWS project's
+  `ContainerTarget::for_project` is its tunnel's endpoint, its stored `container_id` is that
+  endpoint's URL, and the AWS death watch confirms exits through the registry. Shutdown closes
+  every tunnel (`for_project` is `None` while none is open; `for_project_waiting` covers the
+  background re-attach after an app restart). AWS SDK calls stay in `aws/` (`runtime.rs`,
+  `tasks.rs`, `workspace.rs`).
+  `agent.rs` reuses `docker/exec.rs`'s `OneshotOutput`, host-file reader and uid probe so the two
+  variants cannot drift; an `Agent` target's token never appears in `Debug` or error text.
+  **Container-interior code must go through `ContainerTarget`, never `docker::exec`, bollard or
+  `get_docker()`** — `host::tests::no_container_interior_bollard_outside_the_host_layer` fails
+  the build on it. `lifecycle.rs`'s `ProjectHost` owns create/start/stop/find/remove and
+  discarding a project's persistent state; the project commands keep only host-neutral steps
+  (validation, status, sessions, auth bridge, syncs). `watch.rs` gives `container_watch` its
+  death reports and positive-exit check. `no_container_lifecycle_or_bare_docker_targets_outside_the_host_layer`
+  fails on lifecycle calls or `ContainerTarget::docker(id)` in non-test code outside `host/` and
+  `docker/`; get a target from `ContainerTarget::for_project`, `ProjectHost`, or a session
+  (`ExecSessionManager::get_target`). Base-image migration is the one Docker-only exception
+  (`DOCKER_ONLY`); shrink it, never grow it.
+- **`aws/`** — AWS connections (Settings → Hosts) and the permission check. `connection.rs`
+  builds a saved `HostConnection`'s `SdkConfig` **by hand, never with
+  `aws_config::defaults().load()`**: a profile is read through `ProfileFileCredentialsProvider`
+  for credentials only, so the app's own `AWS_*` variables, `AWS_ENDPOINT_URL*` and a profile's
+  endpoint/service settings can't redirect or re-credential a connection's signed requests.
+  `identity.rs` is `GetCallerIdentity` and the principal to simulate (an assumed role's ARN is
+  recovered with `iam:GetRole`, because SSO roles have an `/aws-reserved/…` path the session ARN
+  lacks); `error.rs` classifies SDK errors (SSO expired, access denied naming the action, …);
+  `policies.rs` embeds `aws/policies/*.json` (the tier policies — both tiers span several
+  files, `policy_files` lists them — and the permissions boundary) and the table of checks the
+  simulator is asked; `permissions.rs` runs it
+  (`SimulatePrincipalPolicy`, adaptive retries — it throttles — or read-only probes when the
+  caller can't simulate itself; a probed run never claims the admin tier). `policies.rs`'s tests
+  are the drift guard: every allowed action has a check, every check is allowed by a small IAM
+  evaluator (`policy_eval.rs`, test-only; `tofu_modules/tests.rs` also asks it whether the admin
+  tier allows every call `MODULE_CALLS` lists for the Terraform modules), owner-scoped checks are
+  denied for someone else, admin destruction is tag-scoped, the boundary fences hold, every
+  Resource is an ARN and every policy fits a 6,144-character managed policy. **Change a policy
+  JSON, its checks and `aws/README.md` together.** The evaluator
+  is not IAM: `live_tests.rs` (ignored; `TRIPLEC_AWS_E2E_PROFILE`, `TRIPLEC_AWS_E2E_REGION`,
+  admin credentials for a disposable account; `cargo test aws::live_tests -- --ignored
+  --test-threads=1`) runs the check and real calls against throwaway `triple-c-e2e-*` roles,
+  secrets and keys, and cleans them up. Re-run it after any policy change; the results are in
+  `aws/README.md` ("Live verification"). Its `environment` tests apply the real modules as a role
+  holding only the admin files (`cargo build` first: the runner they start is the built app
+  binary), in a throwaway state bucket.
+  **A Fargate workspace's resources** (`workspace.rs`, `tasks.rs`, `runtime.rs`). **No project
+  data in a task definition (P1):** every workspace user has `ecs:Describe*` on `*`, so
+  `environment`, tags, labels and `overrides` are public to the account. The task definition carries
+  `TRIPLEC_HOST=aws`, `COLORTERM`, the three ownership tags, a fingerprint docker label (a hash,
+  `FINGERPRINT_LABEL`) and `valueFrom` references into the project's **one secret**
+  (`triple-c/<env>/<owner_key>/<project-id>`, JSON, 64 KB cap: files, repos, instructions, settings,
+  custom env, the agent token). The token rotates each start; a running task is attached to by reading
+  it back (the task role has no Secrets Manager access). **Anyone may register a revision into any
+  `triple-c-*` family** (IAM can't scope it), so a revision or task is reused only when it carries the
+  caller's own owner tag + this project's tag (+ the fingerprint), and `RunTask` always names the exact
+  `family:revision` ARN, never "latest". Names come only from `tofu_modules.rs`, built from `owner_key`
+  (`aws:userid` contains `:`). Workspace users can't deregister or delete task definitions
+  (`DeregisterTaskDefinition` is `*`-only in IAM): removal leaves revisions ACTIVE for an admin
+  (`aws/README.md`). Stop: the stop guard (`commands/stop_guard.rs`) dry-runs `triple-c-wip-push`
+  through the agent, closes the project's terminals and auth bridge (so nothing is written after the
+  push's snapshot), may push first (under an in-container `timeout`, since the agent does not kill an
+  exec the client gave up on), then writes `pushed` or `discard` to `/run/triple-c/stop-reason`
+  (root-owned; the entrypoint's TERM hook reads it, and the idle watcher writes `idle`) so the hook
+  doesn't push twice; the marker is cleared if StopTask fails. Claude Code's sandbox is forced off in
+  the generated settings (bubblewrap can't create namespaces on Fargate, verified live).
+  **Environments are OpenTofu modules** (`aws/terraform/{environment,user-onboard,permissions-boundary}`;
+  spec D2–D10). `tofu_modules.rs` embeds them and is the **only** place the shared names are built
+  (environment, `/triple-c/environments/<env>` record, owner key — `sha256("<region>:<aws:userid>")`,
+  12 hex, regional because role names are account-global — per-user roles, state bucket
+  `triple-c-tfstate-<account>-<region>`, state keys); its tests pin the HCL to those names, the
+  versions and tags, and `MODULE_CALLS` (every provider call) to the admin policy.
+  `tofu.rs` downloads the pinned OpenTofu (SHA-256 checked **before** extraction), writes a work
+  folder (`materialize`), builds tofu's environment from scratch (`child_env`: no inherited
+  `AWS_*`/`TF_*`, keys only in the environment) and runs `init` + `apply|destroy` **detached
+  (D10)**: the app binary re-executed with `--tofu-runner` (`main.rs` checks that first), in its
+  own session, logging to `apply.log`; liveness is the runner's `apply.lock`, never a PID; closing
+  the app never stops a run and the next start re-follows the log. `environments.rs` is detection
+  (records + state objects + locks; records are untrusted and capped; an empty state, which
+  `tofu destroy` leaves behind, is no deployment) and `ensure_state_bucket`;
+  `commands/environment_commands.rs` sequences ensure_tofu → ensure_state_bucket → materialize →
+  start → follow. **D2: strict tenancy gives each user their own EFS file system** (its policy
+  admits only their task role) from their onboarding module; the environment keeps only the shared
+  pieces. The app destroys only incomplete deployments (D6); a working environment is removed with
+  `tofu destroy` from an admin bundle (D5).
 - **`web_terminal/`** — Remote terminal access via axum HTTP+WebSocket server:
   - `server.rs` — Axum server lifecycle (start/stop), serves embedded HTML and handles WS upgrades
   - `ws_handler.rs` — Per-connection WebSocket handler with JSON protocol, session management, cleanup on disconnect
@@ -294,6 +389,29 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
 - **`Dockerfile`** — Ubuntu 24.04 base with Claude Code, Node.js 22, Python 3.12, Rust, Docker CLI, git, gh, AWS CLI v2, ripgrep, pnpm, uv, ruff pre-installed, plus the shared
   libraries a browser links against (see below) and the VPN tooling the `vpn_support_enabled`
   toggle grants capability for (`iproute2`, `wireguard-tools`, `iptables`)
+- **`TRIPLEC_HOST=aws` mode** (`entrypoint.sh`, the `aws_*` blocks; inert without it). There are no
+  bind mounts: `TRIPLEC_FILES` (JSON of base64 files) is decoded into `/tmp/.host-ssh` / `/tmp/.host-ca`
+  so the SSH merge and CA install run unchanged, and `TRIPLEC_REPOS` is kept in an unexported shell
+  variable; **both are unset before the agent-token block snapshots the environment** (that snapshot is
+  every terminal's env and the files hold private keys). Repos clone in the background after the agent
+  starts (terminals are usable before they arrive). Hybrid storage mounts EFS at `/mnt/triple-c-home`
+  and symlinks `~/.claude`, `~/.claude.json`, `~/.ssh` into it (mounting over `/home/claude` would hide
+  the image's tooling); root never follows those links outside the mount (`aws_hybrid_ssh_dir`). On
+  TERM the hook pushes unsaved work to a `triple-c/wip/<stamp>` branch via a temporary index (the
+  user's index is untouched; needs the task definition's `stopTimeout` raised, 120 s) unless the stop
+  marker says the app handled it. The idle watcher runs as root under a supervisor and signals the
+  entrypoint's own PID (not PID 1, which is docker-init), so idle and ECS stops share one trap.
+  Idle = the agent's `last_activity_unix` older than N minutes (open-but-silent attaches/tunnels
+  don't count; requests with `X-Triple-C-Background: 1` — the auth bridge's and the file viewer's polls — never do),
+  no `claude`, no scheduler job, no running clone, and no unsaved git work: with the WIP push on the
+  watcher pushes *before* signalling and stays up if that fails; with it off, dirty repos keep the
+  workspace up; activity during the watcher's push sends it back to watching. A repo the background
+  clone is still writing (`/run/triple-c-clone/repos` last says `cloning`, no `done`) is skipped by
+  `triple-c-wip-push` (dry run: `"cloning": true`). The stop trap is set before any background work
+  starts. An idle stop exits 75 (`aws::tasks::IDLE_EXIT_CODE`) so the death watch can tell it
+  from a crash (`classify_stop` → the `ContainerExited` toast).
+  **The `TRIPLEC_` env prefix is reserved** on both hosts (`RESERVED_ENV_PREFIXES`; `workspace.rs`
+  drops custom variables in it): the entrypoint's settings live there.
 - **Browser runtime libraries are baked in; browser *binaries* are not.** A layer runs
   `npx --yes playwright@latest install-deps chromium` as root, so Playwright names its own
   dependencies and the list cannot rot against Ubuntu 24.04's `t64` renames or a new Chromium
@@ -321,6 +439,19 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
   subscription) is what flips a project whose container exits on its own to Stopped and emits
   `project-container-exited` with a `reason` (`exited` toasts; `found_stopped`, the first look of a run, is silent); `useProjectStatusEvents` applies it
 - **`triple-c-scheduler`** — Bash-based scheduled task system for recurring Claude Code invocations
+- **`triple-c-agent/`** — the in-container agent (its own Rust crate; protocol in
+  `docs/superpowers/specs/2026-11-13-triple-c-agent-protocol.md`). Built static by the Dockerfile's
+  `agent-build` stage, started by `entrypoint.sh` **only when a token is configured**, last, as root
+  under a supervisor loop. **Its contract is Docker parity**: an `ExecSpec` must behave through the
+  agent exactly as through `docker exec`. Any change to exec semantics on either side is checked by
+  `host::agent::live_tests::the_agent_answers_exactly_as_docker_exec_does` (ignored; needs an image
+  with the agent — see the crate README). The token never stays in the environment and never touches the
+  writable layer: the entrypoint moves it to a root-only file on `/dev/shm` (tmpfs — a file in the
+  writable layer would ride `docker commit` into the snapshot image) before anything runs, and the
+  agent refuses a token file others can read. The agent is started from an env/cwd snapshot taken
+  at the top of the entrypoint and held **in memory only** (it contains every API key in the env),
+  so execs see the container's configured env, not the script's. The app treats the agent as
+  untrusted: no redirects, capped bodies, timeouts on every small call (`host/agent.rs`).
 
 **`/home/claude` in the image is seed-only.** It is the mount point of the named volume
 `triple-c-home-{projectId}`, so after a project's *first* start the image's copy of that directory
@@ -758,6 +889,12 @@ a project's Docker volumes are deliberately out of scope — this is not a proje
   inside a generic "settings replaced" summary. Read this as the standing example of the class of
   thing to keep checking for in this feature, not a one-off fixed bug — any other field that looks
   like config but is actually a live credential would have the same problem.
+- **AWS connection keys travel in `ExportedSecrets::aws_connection_keys`** (keyed by connection id),
+  exported and restored like the marketplace tokens. `hosts` are **store-owned**: `update_settings`
+  restores them via `restore_host_fields`, and `apply_settings_import` re-applies them through
+  `StoreOwned`. `validate_imported_hosts` runs before any keychain write. The import preview
+  discloses AWS connections, key counts, overwrites (naming the local connection), failed key
+  checks and removals.
 - **Marketplace account tokens travel in `ExportedSecrets`, not in `AppSettings`.** `Token` and
   `GhContainer` accounts' tokens live in the keychain (`triple-c-marketplace-account-<id>`), so
   they follow the same "carve out of the keychain, restore before the settings replace, only
@@ -877,6 +1014,25 @@ a project's Docker volumes are deliberately out of scope — this is not a proje
 
 ## Packaging
 
+### Releases are cut by hand
+
+**Merging to `main` does not release anything users get.** A release is cut by dispatching
+`build-app.yml` on `main` (Actions -> Build App -> Run workflow). That one run publishes the Gitea
+and GitHub releases for all three platforms, the `vX.Y.Z` tag pinned to the dispatched commit, and
+the Linux update channel. Its last step dispatches `build.yml` and `build-stt.yml` with the new tag,
+and those rebuild that tag and move `:latest`, which is what installed apps pull.
+
+- Dispatching `build-app.yml` on any other branch is a **dry run**. It builds, signs and verifies,
+  and publishes nothing. Every publishing step and job is gated on
+  `gitea.event_name == 'workflow_dispatch' && gitea.ref == 'refs/heads/main'`, so give any new
+  publishing step the same `if:`.
+- A push to `main` that touches `container/` or `stt-container/` publishes only `:edge` and
+  `:<sha>`, never `:latest`. The weekly scheduled sandbox rebuild (OS security fixes) rebuilds the
+  **newest release tag**, not main.
+- This exists so that main can carry dormant work (a feature landing in phases) without each
+  merge shipping. Until the gate, every merge to main touching `app/` released, and every merge
+  touching `container/` moved `:latest`.
+
 Linux ships as **AppImage only**, built by `build-app.yml` (releases) and
 `build-app-preview.yml` (the PR check). The `.deb` and `.rpm` were dropped: two more artifacts to
 build and publish for an audience the AppImage already serves, and neither could self-update. The
@@ -922,8 +1078,8 @@ quietly. **PR previews are deliberately not signed**, and `build-app-preview.yml
 reference the signing secrets. Two reasons: signing is metered (about 1000 signatures a month,
 against roughly 50 preview builds a month), and a PR's workflow runs the PR's own code, so a
 secret available there is available to whoever can push a branch. To exercise signing before a
-merge, dispatch `build-app.yml` on the branch. Every publishing step there is gated on
-`gitea.event_name == 'push'`, so a dispatch builds, signs and verifies without releasing.
+merge, dispatch `build-app.yml` on the branch. Off `main` it builds, signs and verifies
+without releasing (see Releases above).
 
 - `scripts/windows-signing-setup.ps1` runs once per job. It downloads the signing client
   (`Microsoft.ArtifactSigning.Client`) and a .NET runtime into `.code-signing/` in the workspace,
@@ -956,8 +1112,8 @@ app"), never by the preview workflow, never echoed, and never on a command line.
 public, so its Actions logs are too. Gitea masks the secret values, and the signing dlib's
 `/debug` output carries no tokens (checked against its strings). Anyone who can push to this
 repo can reach the secrets through a workflow file, so repo write access is the boundary.
-`main` is branch-protected (no direct or force pushes; changes land by merging a PR), so a signed
-release only ever comes from a merged, visible change. The
+`main` is branch-protected (no direct or force pushes; changes land by merging a PR), and only a
+dispatch on `main` publishes, so a signed release only ever comes from a merged, visible change. The
 Azure side should hold the rest: an app registration with only the signer role on this one
 certificate profile, and a client secret with an expiry. Four things are load-bearing:
 

app/src-tauri/Cargo.toml

@@ -21,17 +21,28 @@ bollard = "0.18"
 keyring = { version = "3", features = ["apple-native", "windows-native", "linux-native"] }
 tokio = { version = "1", features = ["full"] }
 futures-util = "0.3"
+bytes = "1"
 uuid = { version = "1", features = ["v4"] }
 chrono = { version = "0.4", features = ["serde"] }
 dirs = "6"
 log = "0.4"
 fern = { version = "0.7", features = ["date-based"] }
 tar = "0.4"
+# Unpacks the pinned OpenTofu release archive (aws/tofu.rs); every platform's
+# archive is a .tar.gz. The version already in the tree.
+flate2 = "1"
 include_dir = "0.7"
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "multipart"] }
 iana-time-zone = "0.1"
 sha2 = "0.10"
 axum = { version = "0.8", features = ["ws"] }
+# Client side of triple-c-agent's two WebSocket endpoints (host/agent.rs). The
+# same version axum's `ws` already pulls in; plain ws:// only (the transport is
+# loopback or an SSM port-forward), so no TLS features.
+tokio-tungstenite = { version = "0.28", default-features = false, features = ["connect"] }
+# `PollSender`: the agent attach's stdin `AsyncWrite` over a bounded channel.
+# Already in the tree through tokio's ecosystem.
+tokio-util = "0.7"
 tower-http = { version = "0.6", features = ["cors"] }
 base64 = "0.22"
 rand = "0.9"
@@ -47,6 +58,34 @@ similar = "2"
 # Marketplace repos are fetched on the host into a bare cache (spec §3).
 # Blocking client + rustls: no git binary or OpenSSL needed on the host.
 gix = { version = "0.88", default-features = false, features = ["blocking-network-client", "blocking-http-transport-reqwest-rust-tls", "credentials", "sha1"] }
+# AWS host (docs/superpowers/specs/2026-11-13-aws-ecs-host-design.md). The
+# service crates' default `rustls` feature is the *legacy* hyper 0.14 /
+# rustls 0.21 client, a second TLS stack next to the one reqwest already
+# brings; `default-https-client` is the current one, so defaults are off.
+aws-config = { version = "1.13.2", default-features = false, features = ["default-https-client", "rt-tokio", "credentials-process", "sso", "behavior-version-latest"] }
+aws-sdk-ssm = { version = "1.137.0", default-features = false, features = ["default-https-client", "rt-tokio", "behavior-version-latest"] }
+aws-sdk-ecs = { version = "1.159.0", default-features = false, features = ["default-https-client", "rt-tokio", "behavior-version-latest"] }
+aws-sdk-sts = { version = "1.126.0", default-features = false, features = ["default-https-client", "rt-tokio", "behavior-version-latest"] }
+aws-sdk-iam = { version = "1.136.0", default-features = false, features = ["default-https-client", "rt-tokio", "behavior-version-latest"] }
+aws-sdk-secretsmanager = { version = "1.128.0", default-features = false, features = ["default-https-client", "rt-tokio", "behavior-version-latest"] }
+aws-sdk-efs = { version = "1.125.0", default-features = false, features = ["default-https-client", "rt-tokio", "behavior-version-latest"] }
+aws-sdk-cloudwatchlogs = { version = "1.165.0", default-features = false, features = ["default-https-client", "rt-tokio", "behavior-version-latest"] }
+# Named by src/aws/connection.rs: the credentials-provider trait (its profile
+# wrapper) and the profile-file set (aws-config's alias for it is deprecated).
+# Both are the versions aws-config already resolves.
+aws-credential-types = { version = "1.3.1", default-features = false }
+aws-runtime = { version = "1.10.4", default-features = false }
+# The default sleep and time source for the hand-built SdkConfig (no env/profile
+# loading); the version and feature already in the tree.
+aws-smithy-async = { version = "1.3.1", default-features = false, features = ["rt-tokio"] }
+aws-sdk-s3 = { version = "1.159.0", default-features = false, features = ["default-https-client", "rt-tokio", "behavior-version-latest"] }
+
+# aws/tofu.rs: `setsid` puts the detached OpenTofu runner in its own session,
+# and Cancel sends SIGINT to the runner process alone (never a group), which
+# forwards it to `tofu`. Liveness is the runner's `apply.lock`, not a PID.
+# Already in the tree through tokio and friends.
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"
 
 # Linux only: WebKitGTK refuses getUserMedia until the embedder enables media
 # streams and answers the permission request (see src/linux_media.rs). Same
@@ -59,6 +98,11 @@ webkit2gtk = "2.0.2"
 # their backoff schedule under a paused clock instead of in real seconds.
 tokio = { version = "1", features = ["full", "test-util"] }
 tempfile = "3"
+# Only `aws::live_tests` (ignored): it creates a throwaway environment key to
+# check that Secrets Manager and the permissions boundary see its tags.
+aws-sdk-kms = { version = "1.131.0", default-features = false, features = ["default-https-client", "rt-tokio", "behavior-version-latest"] }
+# Only `aws::tofu_modules` tests: they parse the shipped OpenTofu modules.
+hcl-rs = "0.20"
 
 [build-dependencies]
 tauri-build = { version = "2", features = [] }

app/src-tauri/capabilities/default.json

@@ -18,8 +18,12 @@
     "allow-update-project",
     "allow-start-project-container",
     "allow-stop-project-container",
+    "allow-check-unsaved-work",
+    "allow-aws-task-log",
+    "allow-remove-aws-resources",
     "allow-rebuild-project-container",
     "allow-reconcile-project-statuses",
+    "allow-reconcile-aws-projects",
     "allow-list-notes",
     "allow-save-note",
     "allow-delete-note",
@@ -57,6 +61,26 @@
     "allow-detect-aws-config",
     "allow-inspect-ca-cert-path",
     "allow-list-aws-profiles",
+    "allow-add-aws-profile-connection",
+    "allow-add-aws-keys-connection",
+    "allow-update-aws-connection",
+    "allow-remove-host-connection",
+    "allow-aws-connection-identity",
+    "allow-aws-connection-sso-login",
+    "allow-check-aws-permissions",
+    "allow-aws-policy-document",
+    "allow-detect-aws-environments",
+    "allow-deploy-aws-environment",
+    "allow-update-aws-environment",
+    "allow-repair-aws-environment",
+    "allow-destroy-incomplete-aws-environment",
+    "allow-unlock-aws-state",
+    "allow-follow-aws-deployment",
+    "allow-cancel-aws-deployment",
+    "allow-push-aws-saved-state",
+    "allow-onboard-aws-user",
+    "allow-deploy-aws-permissions-boundary",
+    "allow-save-aws-admin-bundle",
     "allow-detect-host-timezone",
     "allow-export-settings",
     "allow-preview-settings-import",

app/src-tauri/gen/schemas/acl-manifests.json

@@ -1 +1 @@
-{"__app-acl__":{"default_permission":null,"permissions":{"allow-acquire-claude-token":{"identifier":"allow-acquire-claude-token","description":"Enables the acquire_claude_token command without any pre-configured scope.","commands":{"allow":["acquire_claude_token"],"deny":[]}},"allow-add-marketplace":{"identifier":"allow-add-marketplace","description":"Enables the add_marketplace command without any pre-configured scope.","commands":{"allow":["add_marketplace"],"deny":[]}},"allow-add-marketplace-gh-host-account":{"identifier":"allow-add-marketplace-gh-host-account","description":"Enables the add_marketplace_gh_host_account command without any pre-configured scope.","commands":{"allow":["add_marketplace_gh_host_account"],"deny":[]}},"allow-add-marketplace-token-account":{"identifier":"allow-add-marketplace-token-account","description":"Enables the add_marketplace_token_account command without any pre-configured scope.","commands":{"allow":["add_marketplace_token_account"],"deny":[]}},"allow-add-project":{"identifier":"allow-add-project","description":"Enables the add_project command without any pre-configured scope.","commands":{"allow":["add_project"],"deny":[]}},"allow-add-scheduled-task":{"identifier":"allow-add-scheduled-task","description":"Enables the add_scheduled_task command without any pre-configured scope.","commands":{"allow":["add_scheduled_task"],"deny":[]}},"allow-apply-marketplace-now":{"identifier":"allow-apply-marketplace-now","description":"Enables the apply_marketplace_now command without any pre-configured scope.","commands":{"allow":["apply_marketplace_now"],"deny":[]}},"allow-apply-settings-import":{"identifier":"allow-apply-settings-import","description":"Enables the apply_settings_import command without any pre-configured scope.","commands":{"allow":["apply_settings_import"],"deny":[]}},"allow-aws-sso-refresh":{"identifier":"allow-aws-sso-refresh","description":"Enables the aws_sso_refresh command without any pre-configured scope.","commands":{"allow":["aws_sso_refresh"],"deny":[]}},"allow-build-gateway-image":{"identifier":"allow-build-gateway-image","description":"Enables the build_gateway_image command without any pre-configured scope.","commands":{"allow":["build_gateway_image"],"deny":[]}},"allow-build-image":{"identifier":"allow-build-image","description":"Enables the build_image command without any pre-configured scope.","commands":{"allow":["build_image"],"deny":[]}},"allow-build-stt-image":{"identifier":"allow-build-stt-image","description":"Enables the build_stt_image command without any pre-configured scope.","commands":{"allow":["build_stt_image"],"deny":[]}},"allow-cancel-claude-token":{"identifier":"allow-cancel-claude-token","description":"Enables the cancel_claude_token command without any pre-configured scope.","commands":{"allow":["cancel_claude_token"],"deny":[]}},"allow-cancel-marketplace-gh-login":{"identifier":"allow-cancel-marketplace-gh-login","description":"Enables the cancel_marketplace_gh_login command without any pre-configured scope.","commands":{"allow":["cancel_marketplace_gh_login"],"deny":[]}},"allow-check-browser-view-support":{"identifier":"allow-check-browser-view-support","description":"Enables the check_browser_view_support command without any pre-configured scope.","commands":{"allow":["check_browser_view_support"],"deny":[]}},"allow-check-docker":{"identifier":"allow-check-docker","description":"Enables the check_docker command without any pre-configured scope.","commands":{"allow":["check_docker"],"deny":[]}},"allow-check-for-updates":{"identifier":"allow-check-for-updates","description":"Enables the check_for_updates command without any pre-configured scope.","commands":{"allow":["check_for_updates"],"deny":[]}},"allow-check-gateway-health":{"identifier":"allow-check-gateway-health","description":"Enables the check_gateway_health command without any pre-configured scope.","commands":{"allow":["check_gateway_health"],"deny":[]}},"allow-check-image-exists":{"identifier":"allow-check-image-exists","description":"Enables the check_image_exists command without any pre-configured scope.","commands":{"allow":["check_image_exists"],"deny":[]}},"allow-check-image-update":{"identifier":"allow-check-image-update","description":"Enables the check_image_update command without any pre-configured scope.","commands":{"allow":["check_image_update"],"deny":[]}},"allow-clear-claude-token":{"identifier":"allow-clear-claude-token","description":"Enables the clear_claude_token command without any pre-configured scope.","commands":{"allow":["clear_claude_token"],"deny":[]}},"allow-clear-gateway-api-key":{"identifier":"allow-clear-gateway-api-key","description":"Enables the clear_gateway_api_key command without any pre-configured scope.","commands":{"allow":["clear_gateway_api_key"],"deny":[]}},"allow-clear-scheduler-notifications":{"identifier":"allow-clear-scheduler-notifications","description":"Enables the clear_scheduler_notifications command without any pre-conLine truncated
+{"__app-acl__":{"default_permission":null,"permissions":{"allow-acquire-claude-token":{"identifier":"allow-acquire-claude-token","description":"Enables the acquire_claude_token command without any pre-configured scope.","commands":{"allow":["acquire_claude_token"],"deny":[]}},"allow-add-aws-keys-connection":{"identifier":"allow-add-aws-keys-connection","description":"Enables the add_aws_keys_connection command without any pre-configured scope.","commands":{"allow":["add_aws_keys_connection"],"deny":[]}},"allow-add-aws-profile-connection":{"identifier":"allow-add-aws-profile-connection","description":"Enables the add_aws_profile_connection command without any pre-configured scope.","commands":{"allow":["add_aws_profile_connection"],"deny":[]}},"allow-add-marketplace":{"identifier":"allow-add-marketplace","description":"Enables the add_marketplace command without any pre-configured scope.","commands":{"allow":["add_marketplace"],"deny":[]}},"allow-add-marketplace-gh-host-account":{"identifier":"allow-add-marketplace-gh-host-account","description":"Enables the add_marketplace_gh_host_account command without any pre-configured scope.","commands":{"allow":["add_marketplace_gh_host_account"],"deny":[]}},"allow-add-marketplace-token-account":{"identifier":"allow-add-marketplace-token-account","description":"Enables the add_marketplace_token_account command without any pre-configured scope.","commands":{"allow":["add_marketplace_token_account"],"deny":[]}},"allow-add-project":{"identifier":"allow-add-project","description":"Enables the add_project command without any pre-configured scope.","commands":{"allow":["add_project"],"deny":[]}},"allow-add-scheduled-task":{"identifier":"allow-add-scheduled-task","description":"Enables the add_scheduled_task command without any pre-configured scope.","commands":{"allow":["add_scheduled_task"],"deny":[]}},"allow-apply-marketplace-now":{"identifier":"allow-apply-marketplace-now","description":"Enables the apply_marketplace_now command without any pre-configured scope.","commands":{"allow":["apply_marketplace_now"],"deny":[]}},"allow-apply-settings-import":{"identifier":"allow-apply-settings-import","description":"Enables the apply_settings_import command without any pre-configured scope.","commands":{"allow":["apply_settings_import"],"deny":[]}},"allow-aws-connection-identity":{"identifier":"allow-aws-connection-identity","description":"Enables the aws_connection_identity command without any pre-configured scope.","commands":{"allow":["aws_connection_identity"],"deny":[]}},"allow-aws-connection-sso-login":{"identifier":"allow-aws-connection-sso-login","description":"Enables the aws_connection_sso_login command without any pre-configured scope.","commands":{"allow":["aws_connection_sso_login"],"deny":[]}},"allow-aws-policy-document":{"identifier":"allow-aws-policy-document","description":"Enables the aws_policy_document command without any pre-configured scope.","commands":{"allow":["aws_policy_document"],"deny":[]}},"allow-aws-sso-refresh":{"identifier":"allow-aws-sso-refresh","description":"Enables the aws_sso_refresh command without any pre-configured scope.","commands":{"allow":["aws_sso_refresh"],"deny":[]}},"allow-aws-task-log":{"identifier":"allow-aws-task-log","description":"Enables the aws_task_log command without any pre-configured scope.","commands":{"allow":["aws_task_log"],"deny":[]}},"allow-build-gateway-image":{"identifier":"allow-build-gateway-image","description":"Enables the build_gateway_image command without any pre-configured scope.","commands":{"allow":["build_gateway_image"],"deny":[]}},"allow-build-image":{"identifier":"allow-build-image","description":"Enables the build_image command without any pre-configured scope.","commands":{"allow":["build_image"],"deny":[]}},"allow-build-stt-image":{"identifier":"allow-build-stt-image","description":"Enables the build_stt_image command without any pre-configured scope.","commands":{"allow":["build_stt_image"],"deny":[]}},"allow-cancel-aws-deployment":{"identifier":"allow-cancel-aws-deployment","description":"Enables the cancel_aws_deployment command without any pre-configured scope.","commands":{"allow":["cancel_aws_deployment"],"deny":[]}},"allow-cancel-claude-token":{"identifier":"allow-cancel-claude-token","description":"Enables the cancel_claude_token command without any pre-configured scope.","commands":{"allow":["cancel_claude_token"],"deny":[]}},"allow-cancel-marketplace-gh-login":{"identifier":"allow-cancel-marketplace-gh-login","description":"Enables the cancel_marketplace_gh_login command without any pre-configured scope.","commands":{"allow":["cancel_marketplace_gh_login"],"deny":[]}},"allow-check-aws-permissions":{"identifier":"allow-check-aws-permissions","description":"Enables the check_aws_permissions command without any pre-configured scope.","commands":{"allow":["check_aws_permissions"],"deny":[]}},"allow-check-browser-view-support":{"identifier":"allow-check-browser-view-support","description":Line truncated

app/src-tauri/gen/schemas/capabilities.json

@@ -1 +1 @@
-{"default":{"identifier":"default","description":"Default capabilities for Triple-C. Every entry here is an IPC command a compromised webview can call directly, so the set is an enumeration of what `app/src` actually invokes — plugin and core grants verified against tauri 2.11.0's `PLUGINS` table in tauri's own `build.rs` rather than assumed from a plugin's `default` set, app-command grants (the bare `allow-*` entries) cross-checked by this crate's `build.rs` against `generate_handler!`. `core:default` in particular is NOT used: it is an alias for `core:{path,event,window,webview,app,image,resources,menu,tray}:default`, and `core:image:default` carries `allow-from-path`, whose handler (`tauri-2.11.0/src/image/plugin.rs:41` → `src/image/mod.rs:96`) is a bare `std::fs::read(path)` with no scope mechanism of any kind. Nothing imports `@tauri-apps/api/image`, so the whole plugin is dropped rather than scoped — there is nothing to scope it with. `core:menu` and `core:tray` are dropped for the same reason (no menu, no tray icon); `core:window` and `core:path` because nothing imports them; `core:resources:allow-close` because no frontend value is a `Resource`; and `core:event`'s `allow-emit`/`allow-emit-to` because the frontend only ever *listens* — every emit in this app originates in Rust. Three notes on what is deliberately kept or accepted: (1) `core:webview:allow-internal-toggle-devtools` is not called by `app/src` at all — it is called by Tauri's own injected `toggle-devtools.js`, which binds Ctrl/Cmd+Shift+I. Both that script and the command behind it are `#[cfg(any(debug_assertions, feature = \"devtools\"))]`, so this grant is a `tauri dev` convenience that does not exist in a release bundle. (2) `opener:allow-open-url` is **gone**. It could not be narrowed by host — `TerminalView`'s `WebLinksAddon` opens links Claude printed inside the container, which are arbitrary by construction, so a host allowlist would have deleted the feature rather than bounded it — and it was carried here as an accepted residual risk: a compromised webview could make the OS open an attacker-chosen http(s) URL, an outbound channel. That risk is now closed rather than recorded. Every host-browser open in the app goes through the `open_url_external` command in `url_open.rs`, which exists because the AppImage environment leaks into a cold-launched browser on Linux (triple-c#34) and which re-validates the URL in Rust — scheme allowlist, no embedded credentials, no control characters, length cap, ASCII asserted before `execvp`. On macOS and Windows that command reaches the same plugin as before, via `OpenerExt::open_url`, whose desktop implementation calls `crate::open::open` directly and is therefore not gated by this file at all (`tauri-plugin-opener-2.5.3/src/lib.rs:60`). The plugin stays a dependency for exactly that reason; what is removed is the webview's ability to reach it without passing the Rust validation. (3) `drag:allow-start-drag` is **gone**, together with the OS drag-out it existed for. It could not be scoped — `tauri-plugin-drag` takes the item paths from the caller and has no scope mechanism, so a compromised webview could call `startDrag({ item: ['~/.ssh/id_rsa'] })` against any host path the user can read — and it was carried as an accepted residual risk for one gesture. Drag-out was held back for separate hardening (see branch `hold/disk-and-dragout`) and the plugin is no longer a dependency. Getting a file *out* of a container is either \"Back up container\" on the project's Overview tab, which archives a tree through the Docker API, or the Files tab's per-row \"Save to host…\", which copies one file; getting one *in* is a drop on the Terminal or the Files tab's \"Upload…\". None of the four touches this permission. The Files tab's two are worth separating out here, because they are the only host-path commands in the app whose dialog is opened by **Rust** rather than by the webview — `pick_save_path` and `pick_files_to_upload` in `commands/file_commands.rs` drive `tauri-plugin-dialog` from the backend, so a compromised webview can ask for a picker and nothing more: it cannot name a host path as an *input* to either command. Be precise about the limit of that claim — host paths do still travel outward in error text (`Failed to create /home/j/Documents/x.txt.triple-c-part-1a2b3c4d: Permission denied`), including canonicalized ones, which disclose symlink targets. That is accepted; the app already hands the webview the project paths. What is closed is the direction that mattered — the webview naming where bytes go. That is the shape an earlier revision of this file named as the honest one if the Files tab ever regained host I/O, and it is the shape it regained it in. The `dialog:allow-open` / `dialog:allow-save` grants below are therefore *not* what those two use; they remain for the frontend pickers in Add Project, the Config tab's workspace and access sections, the CA-certificate fielLine truncated
+{"default":{"identifier":"default","description":"Default capabilities for Triple-C. Every entry here is an IPC command a compromised webview can call directly, so the set is an enumeration of what `app/src` actually invokes — plugin and core grants verified against tauri 2.11.0's `PLUGINS` table in tauri's own `build.rs` rather than assumed from a plugin's `default` set, app-command grants (the bare `allow-*` entries) cross-checked by this crate's `build.rs` against `generate_handler!`. `core:default` in particular is NOT used: it is an alias for `core:{path,event,window,webview,app,image,resources,menu,tray}:default`, and `core:image:default` carries `allow-from-path`, whose handler (`tauri-2.11.0/src/image/plugin.rs:41` → `src/image/mod.rs:96`) is a bare `std::fs::read(path)` with no scope mechanism of any kind. Nothing imports `@tauri-apps/api/image`, so the whole plugin is dropped rather than scoped — there is nothing to scope it with. `core:menu` and `core:tray` are dropped for the same reason (no menu, no tray icon); `core:window` and `core:path` because nothing imports them; `core:resources:allow-close` because no frontend value is a `Resource`; and `core:event`'s `allow-emit`/`allow-emit-to` because the frontend only ever *listens* — every emit in this app originates in Rust. Three notes on what is deliberately kept or accepted: (1) `core:webview:allow-internal-toggle-devtools` is not called by `app/src` at all — it is called by Tauri's own injected `toggle-devtools.js`, which binds Ctrl/Cmd+Shift+I. Both that script and the command behind it are `#[cfg(any(debug_assertions, feature = \"devtools\"))]`, so this grant is a `tauri dev` convenience that does not exist in a release bundle. (2) `opener:allow-open-url` is **gone**. It could not be narrowed by host — `TerminalView`'s `WebLinksAddon` opens links Claude printed inside the container, which are arbitrary by construction, so a host allowlist would have deleted the feature rather than bounded it — and it was carried here as an accepted residual risk: a compromised webview could make the OS open an attacker-chosen http(s) URL, an outbound channel. That risk is now closed rather than recorded. Every host-browser open in the app goes through the `open_url_external` command in `url_open.rs`, which exists because the AppImage environment leaks into a cold-launched browser on Linux (triple-c#34) and which re-validates the URL in Rust — scheme allowlist, no embedded credentials, no control characters, length cap, ASCII asserted before `execvp`. On macOS and Windows that command reaches the same plugin as before, via `OpenerExt::open_url`, whose desktop implementation calls `crate::open::open` directly and is therefore not gated by this file at all (`tauri-plugin-opener-2.5.3/src/lib.rs:60`). The plugin stays a dependency for exactly that reason; what is removed is the webview's ability to reach it without passing the Rust validation. (3) `drag:allow-start-drag` is **gone**, together with the OS drag-out it existed for. It could not be scoped — `tauri-plugin-drag` takes the item paths from the caller and has no scope mechanism, so a compromised webview could call `startDrag({ item: ['~/.ssh/id_rsa'] })` against any host path the user can read — and it was carried as an accepted residual risk for one gesture. Drag-out was held back for separate hardening (see branch `hold/disk-and-dragout`) and the plugin is no longer a dependency. Getting a file *out* of a container is either \"Back up container\" on the project's Overview tab, which archives a tree through the Docker API, or the Files tab's per-row \"Save to host…\", which copies one file; getting one *in* is a drop on the Terminal or the Files tab's \"Upload…\". None of the four touches this permission. The Files tab's two are worth separating out here, because they are the only host-path commands in the app whose dialog is opened by **Rust** rather than by the webview — `pick_save_path` and `pick_files_to_upload` in `commands/file_commands.rs` drive `tauri-plugin-dialog` from the backend, so a compromised webview can ask for a picker and nothing more: it cannot name a host path as an *input* to either command. Be precise about the limit of that claim — host paths do still travel outward in error text (`Failed to create /home/j/Documents/x.txt.triple-c-part-1a2b3c4d: Permission denied`), including canonicalized ones, which disclose symlink targets. That is accepted; the app already hands the webview the project paths. What is closed is the direction that mattered — the webview naming where bytes go. That is the shape an earlier revision of this file named as the honest one if the Files tab ever regained host I/O, and it is the shape it regained it in. The `dialog:allow-open` / `dialog:allow-save` grants below are therefore *not* what those two use; they remain for the frontend pickers in Add Project, the Config tab's workspace and access sections, the CA-certificate fielLine truncated

app/src-tauri/gen/schemas/desktop-schema.json

@@ -350,6 +350,18 @@
           "const": "allow-acquire-claude-token",
           "markdownDescription": "Enables the acquire_claude_token command without any pre-configured scope."
         },
+        {
+          "description": "Enables the add_aws_keys_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-add-aws-keys-connection",
+          "markdownDescription": "Enables the add_aws_keys_connection command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the add_aws_profile_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-add-aws-profile-connection",
+          "markdownDescription": "Enables the add_aws_profile_connection command without any pre-configured scope."
+        },
         {
           "description": "Enables the add_marketplace command without any pre-configured scope.",
           "type": "string",
@@ -392,12 +404,36 @@
           "const": "allow-apply-settings-import",
           "markdownDescription": "Enables the apply_settings_import command without any pre-configured scope."
         },
+        {
+          "description": "Enables the aws_connection_identity command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-aws-connection-identity",
+          "markdownDescription": "Enables the aws_connection_identity command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the aws_connection_sso_login command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-aws-connection-sso-login",
+          "markdownDescription": "Enables the aws_connection_sso_login command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the aws_policy_document command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-aws-policy-document",
+          "markdownDescription": "Enables the aws_policy_document command without any pre-configured scope."
+        },
         {
           "description": "Enables the aws_sso_refresh command without any pre-configured scope.",
           "type": "string",
           "const": "allow-aws-sso-refresh",
           "markdownDescription": "Enables the aws_sso_refresh command without any pre-configured scope."
         },
+        {
+          "description": "Enables the aws_task_log command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-aws-task-log",
+          "markdownDescription": "Enables the aws_task_log command without any pre-configured scope."
+        },
         {
           "description": "Enables the build_gateway_image command without any pre-configured scope.",
           "type": "string",
@@ -416,6 +452,12 @@
           "const": "allow-build-stt-image",
           "markdownDescription": "Enables the build_stt_image command without any pre-configured scope."
         },
+        {
+          "description": "Enables the cancel_aws_deployment command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-cancel-aws-deployment",
+          "markdownDescription": "Enables the cancel_aws_deployment command without any pre-configured scope."
+        },
         {
           "description": "Enables the cancel_claude_token command without any pre-configured scope.",
           "type": "string",
@@ -428,6 +470,12 @@
           "const": "allow-cancel-marketplace-gh-login",
           "markdownDescription": "Enables the cancel_marketplace_gh_login command without any pre-configured scope."
         },
+        {
+          "description": "Enables the check_aws_permissions command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-check-aws-permissions",
+          "markdownDescription": "Enables the check_aws_permissions command without any pre-configured scope."
+        },
         {
           "description": "Enables the check_browser_view_support command without any pre-configured scope.",
           "type": "string",
@@ -464,6 +512,12 @@
           "const": "allow-check-image-update",
           "markdownDescription": "Enables the check_image_update command without any pre-configured scope."
         },
+        {
+          "description": "Enables the check_unsaved_work command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-check-unsaved-work",
+          "markdownDescription": "Enables the check_unsaved_work command without any pre-configured scope."
+        },
         {
           "description": "Enables the clear_claude_token command without any pre-configured scope.",
           "type": "string",
@@ -518,12 +572,36 @@
           "const": "allow-delete-note",
           "markdownDescription": "Enables the delete_note command without any pre-configured scope."
         },
+        {
+          "description": "Enables the deploy_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-deploy-aws-environment",
+          "markdownDescription": "Enables the deploy_aws_environment command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the deploy_aws_permissions_boundary command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-deploy-aws-permissions-boundary",
+          "markdownDescription": "Enables the deploy_aws_permissions_boundary command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the destroy_incomplete_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-destroy-incomplete-aws-environment",
+          "markdownDescription": "Enables the destroy_incomplete_aws_environment command without any pre-configured scope."
+        },
         {
           "description": "Enables the detect_aws_config command without any pre-configured scope.",
           "type": "string",
           "const": "allow-detect-aws-config",
           "markdownDescription": "Enables the detect_aws_config command without any pre-configured scope."
         },
+        {
+          "description": "Enables the detect_aws_environments command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-detect-aws-environments",
+          "markdownDescription": "Enables the detect_aws_environments command without any pre-configured scope."
+        },
         {
           "description": "Enables the detect_host_timezone command without any pre-configured scope.",
           "type": "string",
@@ -554,6 +632,12 @@
           "const": "allow-export-settings",
           "markdownDescription": "Enables the export_settings command without any pre-configured scope."
         },
+        {
+          "description": "Enables the follow_aws_deployment command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-follow-aws-deployment",
+          "markdownDescription": "Enables the follow_aws_deployment command without any pre-configured scope."
+        },
         {
           "description": "Enables the forget_marketplace_installs command without any pre-configured scope.",
           "type": "string",
@@ -770,6 +854,12 @@
           "const": "allow-migrate-project-to-base",
           "markdownDescription": "Enables the migrate_project_to_base command without any pre-configured scope."
         },
+        {
+          "description": "Enables the onboard_aws_user command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-onboard-aws-user",
+          "markdownDescription": "Enables the onboard_aws_user command without any pre-configured scope."
+        },
         {
           "description": "Enables the open_browser_view_popout command without any pre-configured scope.",
           "type": "string",
@@ -830,6 +920,12 @@
           "const": "allow-pull-stt-image",
           "markdownDescription": "Enables the pull_stt_image command without any pre-configured scope."
         },
+        {
+          "description": "Enables the push_aws_saved_state command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-push-aws-saved-state",
+          "markdownDescription": "Enables the push_aws_saved_state command without any pre-configured scope."
+        },
         {
           "description": "Enables the read_container_file command without any pre-configured scope.",
           "type": "string",
@@ -842,6 +938,12 @@
           "const": "allow-rebuild-project-container",
           "markdownDescription": "Enables the rebuild_project_container command without any pre-configured scope."
         },
+        {
+          "description": "Enables the reconcile_aws_projects command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-reconcile-aws-projects",
+          "markdownDescription": "Enables the reconcile_aws_projects command without any pre-configured scope."
+        },
         {
           "description": "Enables the reconcile_project_statuses command without any pre-configured scope.",
           "type": "string",
@@ -866,6 +968,18 @@
           "const": "allow-regenerate-web-terminal-token",
           "markdownDescription": "Enables the regenerate_web_terminal_token command without any pre-configured scope."
         },
+        {
+          "description": "Enables the remove_aws_resources command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-remove-aws-resources",
+          "markdownDescription": "Enables the remove_aws_resources command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the remove_host_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-remove-host-connection",
+          "markdownDescription": "Enables the remove_host_connection command without any pre-configured scope."
+        },
         {
           "description": "Enables the remove_marketplace command without any pre-configured scope.",
           "type": "string",
@@ -896,6 +1010,12 @@
           "const": "allow-rename-container-path",
           "markdownDescription": "Enables the rename_container_path command without any pre-configured scope."
         },
+        {
+          "description": "Enables the repair_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-repair-aws-environment",
+          "markdownDescription": "Enables the repair_aws_environment command without any pre-configured scope."
+        },
         {
           "description": "Enables the rollback_migration command without any pre-configured scope.",
           "type": "string",
@@ -914,6 +1034,12 @@
           "const": "allow-run-scheduled-task-now",
           "markdownDescription": "Enables the run_scheduled_task_now command without any pre-configured scope."
         },
+        {
+          "description": "Enables the save_aws_admin_bundle command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-save-aws-admin-bundle",
+          "markdownDescription": "Enables the save_aws_admin_bundle command without any pre-configured scope."
+        },
         {
           "description": "Enables the save_note command without any pre-configured scope.",
           "type": "string",
@@ -1082,6 +1208,24 @@
           "const": "allow-uninstall-marketplace-item",
           "markdownDescription": "Enables the uninstall_marketplace_item command without any pre-configured scope."
         },
+        {
+          "description": "Enables the unlock_aws_state command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-unlock-aws-state",
+          "markdownDescription": "Enables the unlock_aws_state command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the update_aws_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-update-aws-connection",
+          "markdownDescription": "Enables the update_aws_connection command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the update_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-update-aws-environment",
+          "markdownDescription": "Enables the update_aws_environment command without any pre-configured scope."
+        },
         {
           "description": "Enables the update_marketplace command without any pre-configured scope.",
           "type": "string",
@@ -1160,6 +1304,18 @@
           "const": "deny-acquire-claude-token",
           "markdownDescription": "Denies the acquire_claude_token command without any pre-configured scope."
         },
+        {
+          "description": "Denies the add_aws_keys_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-add-aws-keys-connection",
+          "markdownDescription": "Denies the add_aws_keys_connection command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the add_aws_profile_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-add-aws-profile-connection",
+          "markdownDescription": "Denies the add_aws_profile_connection command without any pre-configured scope."
+        },
         {
           "description": "Denies the add_marketplace command without any pre-configured scope.",
           "type": "string",
@@ -1202,12 +1358,36 @@
           "const": "deny-apply-settings-import",
           "markdownDescription": "Denies the apply_settings_import command without any pre-configured scope."
         },
+        {
+          "description": "Denies the aws_connection_identity command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-aws-connection-identity",
+          "markdownDescription": "Denies the aws_connection_identity command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the aws_connection_sso_login command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-aws-connection-sso-login",
+          "markdownDescription": "Denies the aws_connection_sso_login command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the aws_policy_document command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-aws-policy-document",
+          "markdownDescription": "Denies the aws_policy_document command without any pre-configured scope."
+        },
         {
           "description": "Denies the aws_sso_refresh command without any pre-configured scope.",
           "type": "string",
           "const": "deny-aws-sso-refresh",
           "markdownDescription": "Denies the aws_sso_refresh command without any pre-configured scope."
         },
+        {
+          "description": "Denies the aws_task_log command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-aws-task-log",
+          "markdownDescription": "Denies the aws_task_log command without any pre-configured scope."
+        },
         {
           "description": "Denies the build_gateway_image command without any pre-configured scope.",
           "type": "string",
@@ -1226,6 +1406,12 @@
           "const": "deny-build-stt-image",
           "markdownDescription": "Denies the build_stt_image command without any pre-configured scope."
         },
+        {
+          "description": "Denies the cancel_aws_deployment command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-cancel-aws-deployment",
+          "markdownDescription": "Denies the cancel_aws_deployment command without any pre-configured scope."
+        },
         {
           "description": "Denies the cancel_claude_token command without any pre-configured scope.",
           "type": "string",
@@ -1238,6 +1424,12 @@
           "const": "deny-cancel-marketplace-gh-login",
           "markdownDescription": "Denies the cancel_marketplace_gh_login command without any pre-configured scope."
         },
+        {
+          "description": "Denies the check_aws_permissions command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-check-aws-permissions",
+          "markdownDescription": "Denies the check_aws_permissions command without any pre-configured scope."
+        },
         {
           "description": "Denies the check_browser_view_support command without any pre-configured scope.",
           "type": "string",
@@ -1274,6 +1466,12 @@
           "const": "deny-check-image-update",
           "markdownDescription": "Denies the check_image_update command without any pre-configured scope."
         },
+        {
+          "description": "Denies the check_unsaved_work command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-check-unsaved-work",
+          "markdownDescription": "Denies the check_unsaved_work command without any pre-configured scope."
+        },
         {
           "description": "Denies the clear_claude_token command without any pre-configured scope.",
           "type": "string",
@@ -1328,12 +1526,36 @@
           "const": "deny-delete-note",
           "markdownDescription": "Denies the delete_note command without any pre-configured scope."
         },
+        {
+          "description": "Denies the deploy_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-deploy-aws-environment",
+          "markdownDescription": "Denies the deploy_aws_environment command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the deploy_aws_permissions_boundary command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-deploy-aws-permissions-boundary",
+          "markdownDescription": "Denies the deploy_aws_permissions_boundary command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the destroy_incomplete_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-destroy-incomplete-aws-environment",
+          "markdownDescription": "Denies the destroy_incomplete_aws_environment command without any pre-configured scope."
+        },
         {
           "description": "Denies the detect_aws_config command without any pre-configured scope.",
           "type": "string",
           "const": "deny-detect-aws-config",
           "markdownDescription": "Denies the detect_aws_config command without any pre-configured scope."
         },
+        {
+          "description": "Denies the detect_aws_environments command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-detect-aws-environments",
+          "markdownDescription": "Denies the detect_aws_environments command without any pre-configured scope."
+        },
         {
           "description": "Denies the detect_host_timezone command without any pre-configured scope.",
           "type": "string",
@@ -1364,6 +1586,12 @@
           "const": "deny-export-settings",
           "markdownDescription": "Denies the export_settings command without any pre-configured scope."
         },
+        {
+          "description": "Denies the follow_aws_deployment command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-follow-aws-deployment",
+          "markdownDescription": "Denies the follow_aws_deployment command without any pre-configured scope."
+        },
         {
           "description": "Denies the forget_marketplace_installs command without any pre-configured scope.",
           "type": "string",
@@ -1580,6 +1808,12 @@
           "const": "deny-migrate-project-to-base",
           "markdownDescription": "Denies the migrate_project_to_base command without any pre-configured scope."
         },
+        {
+          "description": "Denies the onboard_aws_user command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-onboard-aws-user",
+          "markdownDescription": "Denies the onboard_aws_user command without any pre-configured scope."
+        },
         {
           "description": "Denies the open_browser_view_popout command without any pre-configured scope.",
           "type": "string",
@@ -1640,6 +1874,12 @@
           "const": "deny-pull-stt-image",
           "markdownDescription": "Denies the pull_stt_image command without any pre-configured scope."
         },
+        {
+          "description": "Denies the push_aws_saved_state command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-push-aws-saved-state",
+          "markdownDescription": "Denies the push_aws_saved_state command without any pre-configured scope."
+        },
         {
           "description": "Denies the read_container_file command without any pre-configured scope.",
           "type": "string",
@@ -1652,6 +1892,12 @@
           "const": "deny-rebuild-project-container",
           "markdownDescription": "Denies the rebuild_project_container command without any pre-configured scope."
         },
+        {
+          "description": "Denies the reconcile_aws_projects command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-reconcile-aws-projects",
+          "markdownDescription": "Denies the reconcile_aws_projects command without any pre-configured scope."
+        },
         {
           "description": "Denies the reconcile_project_statuses command without any pre-configured scope.",
           "type": "string",
@@ -1676,6 +1922,18 @@
           "const": "deny-regenerate-web-terminal-token",
           "markdownDescription": "Denies the regenerate_web_terminal_token command without any pre-configured scope."
         },
+        {
+          "description": "Denies the remove_aws_resources command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-remove-aws-resources",
+          "markdownDescription": "Denies the remove_aws_resources command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the remove_host_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-remove-host-connection",
+          "markdownDescription": "Denies the remove_host_connection command without any pre-configured scope."
+        },
         {
           "description": "Denies the remove_marketplace command without any pre-configured scope.",
           "type": "string",
@@ -1706,6 +1964,12 @@
           "const": "deny-rename-container-path",
           "markdownDescription": "Denies the rename_container_path command without any pre-configured scope."
         },
+        {
+          "description": "Denies the repair_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-repair-aws-environment",
+          "markdownDescription": "Denies the repair_aws_environment command without any pre-configured scope."
+        },
         {
           "description": "Denies the rollback_migration command without any pre-configured scope.",
           "type": "string",
@@ -1724,6 +1988,12 @@
           "const": "deny-run-scheduled-task-now",
           "markdownDescription": "Denies the run_scheduled_task_now command without any pre-configured scope."
         },
+        {
+          "description": "Denies the save_aws_admin_bundle command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-save-aws-admin-bundle",
+          "markdownDescription": "Denies the save_aws_admin_bundle command without any pre-configured scope."
+        },
         {
           "description": "Denies the save_note command without any pre-configured scope.",
           "type": "string",
@@ -1892,6 +2162,24 @@
           "const": "deny-uninstall-marketplace-item",
           "markdownDescription": "Denies the uninstall_marketplace_item command without any pre-configured scope."
         },
+        {
+          "description": "Denies the unlock_aws_state command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-unlock-aws-state",
+          "markdownDescription": "Denies the unlock_aws_state command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the update_aws_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-update-aws-connection",
+          "markdownDescription": "Denies the update_aws_connection command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the update_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-update-aws-environment",
+          "markdownDescription": "Denies the update_aws_environment command without any pre-configured scope."
+        },
         {
           "description": "Denies the update_marketplace command without any pre-configured scope.",
           "type": "string",

app/src-tauri/gen/schemas/linux-schema.json

@@ -350,6 +350,18 @@
           "const": "allow-acquire-claude-token",
           "markdownDescription": "Enables the acquire_claude_token command without any pre-configured scope."
         },
+        {
+          "description": "Enables the add_aws_keys_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-add-aws-keys-connection",
+          "markdownDescription": "Enables the add_aws_keys_connection command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the add_aws_profile_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-add-aws-profile-connection",
+          "markdownDescription": "Enables the add_aws_profile_connection command without any pre-configured scope."
+        },
         {
           "description": "Enables the add_marketplace command without any pre-configured scope.",
           "type": "string",
@@ -392,12 +404,36 @@
           "const": "allow-apply-settings-import",
           "markdownDescription": "Enables the apply_settings_import command without any pre-configured scope."
         },
+        {
+          "description": "Enables the aws_connection_identity command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-aws-connection-identity",
+          "markdownDescription": "Enables the aws_connection_identity command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the aws_connection_sso_login command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-aws-connection-sso-login",
+          "markdownDescription": "Enables the aws_connection_sso_login command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the aws_policy_document command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-aws-policy-document",
+          "markdownDescription": "Enables the aws_policy_document command without any pre-configured scope."
+        },
         {
           "description": "Enables the aws_sso_refresh command without any pre-configured scope.",
           "type": "string",
           "const": "allow-aws-sso-refresh",
           "markdownDescription": "Enables the aws_sso_refresh command without any pre-configured scope."
         },
+        {
+          "description": "Enables the aws_task_log command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-aws-task-log",
+          "markdownDescription": "Enables the aws_task_log command without any pre-configured scope."
+        },
         {
           "description": "Enables the build_gateway_image command without any pre-configured scope.",
           "type": "string",
@@ -416,6 +452,12 @@
           "const": "allow-build-stt-image",
           "markdownDescription": "Enables the build_stt_image command without any pre-configured scope."
         },
+        {
+          "description": "Enables the cancel_aws_deployment command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-cancel-aws-deployment",
+          "markdownDescription": "Enables the cancel_aws_deployment command without any pre-configured scope."
+        },
         {
           "description": "Enables the cancel_claude_token command without any pre-configured scope.",
           "type": "string",
@@ -428,6 +470,12 @@
           "const": "allow-cancel-marketplace-gh-login",
           "markdownDescription": "Enables the cancel_marketplace_gh_login command without any pre-configured scope."
         },
+        {
+          "description": "Enables the check_aws_permissions command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-check-aws-permissions",
+          "markdownDescription": "Enables the check_aws_permissions command without any pre-configured scope."
+        },
         {
           "description": "Enables the check_browser_view_support command without any pre-configured scope.",
           "type": "string",
@@ -464,6 +512,12 @@
           "const": "allow-check-image-update",
           "markdownDescription": "Enables the check_image_update command without any pre-configured scope."
         },
+        {
+          "description": "Enables the check_unsaved_work command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-check-unsaved-work",
+          "markdownDescription": "Enables the check_unsaved_work command without any pre-configured scope."
+        },
         {
           "description": "Enables the clear_claude_token command without any pre-configured scope.",
           "type": "string",
@@ -518,12 +572,36 @@
           "const": "allow-delete-note",
           "markdownDescription": "Enables the delete_note command without any pre-configured scope."
         },
+        {
+          "description": "Enables the deploy_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-deploy-aws-environment",
+          "markdownDescription": "Enables the deploy_aws_environment command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the deploy_aws_permissions_boundary command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-deploy-aws-permissions-boundary",
+          "markdownDescription": "Enables the deploy_aws_permissions_boundary command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the destroy_incomplete_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-destroy-incomplete-aws-environment",
+          "markdownDescription": "Enables the destroy_incomplete_aws_environment command without any pre-configured scope."
+        },
         {
           "description": "Enables the detect_aws_config command without any pre-configured scope.",
           "type": "string",
           "const": "allow-detect-aws-config",
           "markdownDescription": "Enables the detect_aws_config command without any pre-configured scope."
         },
+        {
+          "description": "Enables the detect_aws_environments command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-detect-aws-environments",
+          "markdownDescription": "Enables the detect_aws_environments command without any pre-configured scope."
+        },
         {
           "description": "Enables the detect_host_timezone command without any pre-configured scope.",
           "type": "string",
@@ -554,6 +632,12 @@
           "const": "allow-export-settings",
           "markdownDescription": "Enables the export_settings command without any pre-configured scope."
         },
+        {
+          "description": "Enables the follow_aws_deployment command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-follow-aws-deployment",
+          "markdownDescription": "Enables the follow_aws_deployment command without any pre-configured scope."
+        },
         {
           "description": "Enables the forget_marketplace_installs command without any pre-configured scope.",
           "type": "string",
@@ -770,6 +854,12 @@
           "const": "allow-migrate-project-to-base",
           "markdownDescription": "Enables the migrate_project_to_base command without any pre-configured scope."
         },
+        {
+          "description": "Enables the onboard_aws_user command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-onboard-aws-user",
+          "markdownDescription": "Enables the onboard_aws_user command without any pre-configured scope."
+        },
         {
           "description": "Enables the open_browser_view_popout command without any pre-configured scope.",
           "type": "string",
@@ -830,6 +920,12 @@
           "const": "allow-pull-stt-image",
           "markdownDescription": "Enables the pull_stt_image command without any pre-configured scope."
         },
+        {
+          "description": "Enables the push_aws_saved_state command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-push-aws-saved-state",
+          "markdownDescription": "Enables the push_aws_saved_state command without any pre-configured scope."
+        },
         {
           "description": "Enables the read_container_file command without any pre-configured scope.",
           "type": "string",
@@ -842,6 +938,12 @@
           "const": "allow-rebuild-project-container",
           "markdownDescription": "Enables the rebuild_project_container command without any pre-configured scope."
         },
+        {
+          "description": "Enables the reconcile_aws_projects command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-reconcile-aws-projects",
+          "markdownDescription": "Enables the reconcile_aws_projects command without any pre-configured scope."
+        },
         {
           "description": "Enables the reconcile_project_statuses command without any pre-configured scope.",
           "type": "string",
@@ -866,6 +968,18 @@
           "const": "allow-regenerate-web-terminal-token",
           "markdownDescription": "Enables the regenerate_web_terminal_token command without any pre-configured scope."
         },
+        {
+          "description": "Enables the remove_aws_resources command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-remove-aws-resources",
+          "markdownDescription": "Enables the remove_aws_resources command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the remove_host_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-remove-host-connection",
+          "markdownDescription": "Enables the remove_host_connection command without any pre-configured scope."
+        },
         {
           "description": "Enables the remove_marketplace command without any pre-configured scope.",
           "type": "string",
@@ -896,6 +1010,12 @@
           "const": "allow-rename-container-path",
           "markdownDescription": "Enables the rename_container_path command without any pre-configured scope."
         },
+        {
+          "description": "Enables the repair_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-repair-aws-environment",
+          "markdownDescription": "Enables the repair_aws_environment command without any pre-configured scope."
+        },
         {
           "description": "Enables the rollback_migration command without any pre-configured scope.",
           "type": "string",
@@ -914,6 +1034,12 @@
           "const": "allow-run-scheduled-task-now",
           "markdownDescription": "Enables the run_scheduled_task_now command without any pre-configured scope."
         },
+        {
+          "description": "Enables the save_aws_admin_bundle command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-save-aws-admin-bundle",
+          "markdownDescription": "Enables the save_aws_admin_bundle command without any pre-configured scope."
+        },
         {
           "description": "Enables the save_note command without any pre-configured scope.",
           "type": "string",
@@ -1082,6 +1208,24 @@
           "const": "allow-uninstall-marketplace-item",
           "markdownDescription": "Enables the uninstall_marketplace_item command without any pre-configured scope."
         },
+        {
+          "description": "Enables the unlock_aws_state command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-unlock-aws-state",
+          "markdownDescription": "Enables the unlock_aws_state command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the update_aws_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-update-aws-connection",
+          "markdownDescription": "Enables the update_aws_connection command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the update_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-update-aws-environment",
+          "markdownDescription": "Enables the update_aws_environment command without any pre-configured scope."
+        },
         {
           "description": "Enables the update_marketplace command without any pre-configured scope.",
           "type": "string",
@@ -1160,6 +1304,18 @@
           "const": "deny-acquire-claude-token",
           "markdownDescription": "Denies the acquire_claude_token command without any pre-configured scope."
         },
+        {
+          "description": "Denies the add_aws_keys_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-add-aws-keys-connection",
+          "markdownDescription": "Denies the add_aws_keys_connection command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the add_aws_profile_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-add-aws-profile-connection",
+          "markdownDescription": "Denies the add_aws_profile_connection command without any pre-configured scope."
+        },
         {
           "description": "Denies the add_marketplace command without any pre-configured scope.",
           "type": "string",
@@ -1202,12 +1358,36 @@
           "const": "deny-apply-settings-import",
           "markdownDescription": "Denies the apply_settings_import command without any pre-configured scope."
         },
+        {
+          "description": "Denies the aws_connection_identity command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-aws-connection-identity",
+          "markdownDescription": "Denies the aws_connection_identity command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the aws_connection_sso_login command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-aws-connection-sso-login",
+          "markdownDescription": "Denies the aws_connection_sso_login command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the aws_policy_document command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-aws-policy-document",
+          "markdownDescription": "Denies the aws_policy_document command without any pre-configured scope."
+        },
         {
           "description": "Denies the aws_sso_refresh command without any pre-configured scope.",
           "type": "string",
           "const": "deny-aws-sso-refresh",
           "markdownDescription": "Denies the aws_sso_refresh command without any pre-configured scope."
         },
+        {
+          "description": "Denies the aws_task_log command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-aws-task-log",
+          "markdownDescription": "Denies the aws_task_log command without any pre-configured scope."
+        },
         {
           "description": "Denies the build_gateway_image command without any pre-configured scope.",
           "type": "string",
@@ -1226,6 +1406,12 @@
           "const": "deny-build-stt-image",
           "markdownDescription": "Denies the build_stt_image command without any pre-configured scope."
         },
+        {
+          "description": "Denies the cancel_aws_deployment command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-cancel-aws-deployment",
+          "markdownDescription": "Denies the cancel_aws_deployment command without any pre-configured scope."
+        },
         {
           "description": "Denies the cancel_claude_token command without any pre-configured scope.",
           "type": "string",
@@ -1238,6 +1424,12 @@
           "const": "deny-cancel-marketplace-gh-login",
           "markdownDescription": "Denies the cancel_marketplace_gh_login command without any pre-configured scope."
         },
+        {
+          "description": "Denies the check_aws_permissions command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-check-aws-permissions",
+          "markdownDescription": "Denies the check_aws_permissions command without any pre-configured scope."
+        },
         {
           "description": "Denies the check_browser_view_support command without any pre-configured scope.",
           "type": "string",
@@ -1274,6 +1466,12 @@
           "const": "deny-check-image-update",
           "markdownDescription": "Denies the check_image_update command without any pre-configured scope."
         },
+        {
+          "description": "Denies the check_unsaved_work command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-check-unsaved-work",
+          "markdownDescription": "Denies the check_unsaved_work command without any pre-configured scope."
+        },
         {
           "description": "Denies the clear_claude_token command without any pre-configured scope.",
           "type": "string",
@@ -1328,12 +1526,36 @@
           "const": "deny-delete-note",
           "markdownDescription": "Denies the delete_note command without any pre-configured scope."
         },
+        {
+          "description": "Denies the deploy_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-deploy-aws-environment",
+          "markdownDescription": "Denies the deploy_aws_environment command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the deploy_aws_permissions_boundary command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-deploy-aws-permissions-boundary",
+          "markdownDescription": "Denies the deploy_aws_permissions_boundary command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the destroy_incomplete_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-destroy-incomplete-aws-environment",
+          "markdownDescription": "Denies the destroy_incomplete_aws_environment command without any pre-configured scope."
+        },
         {
           "description": "Denies the detect_aws_config command without any pre-configured scope.",
           "type": "string",
           "const": "deny-detect-aws-config",
           "markdownDescription": "Denies the detect_aws_config command without any pre-configured scope."
         },
+        {
+          "description": "Denies the detect_aws_environments command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-detect-aws-environments",
+          "markdownDescription": "Denies the detect_aws_environments command without any pre-configured scope."
+        },
         {
           "description": "Denies the detect_host_timezone command without any pre-configured scope.",
           "type": "string",
@@ -1364,6 +1586,12 @@
           "const": "deny-export-settings",
           "markdownDescription": "Denies the export_settings command without any pre-configured scope."
         },
+        {
+          "description": "Denies the follow_aws_deployment command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-follow-aws-deployment",
+          "markdownDescription": "Denies the follow_aws_deployment command without any pre-configured scope."
+        },
         {
           "description": "Denies the forget_marketplace_installs command without any pre-configured scope.",
           "type": "string",
@@ -1580,6 +1808,12 @@
           "const": "deny-migrate-project-to-base",
           "markdownDescription": "Denies the migrate_project_to_base command without any pre-configured scope."
         },
+        {
+          "description": "Denies the onboard_aws_user command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-onboard-aws-user",
+          "markdownDescription": "Denies the onboard_aws_user command without any pre-configured scope."
+        },
         {
           "description": "Denies the open_browser_view_popout command without any pre-configured scope.",
           "type": "string",
@@ -1640,6 +1874,12 @@
           "const": "deny-pull-stt-image",
           "markdownDescription": "Denies the pull_stt_image command without any pre-configured scope."
         },
+        {
+          "description": "Denies the push_aws_saved_state command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-push-aws-saved-state",
+          "markdownDescription": "Denies the push_aws_saved_state command without any pre-configured scope."
+        },
         {
           "description": "Denies the read_container_file command without any pre-configured scope.",
           "type": "string",
@@ -1652,6 +1892,12 @@
           "const": "deny-rebuild-project-container",
           "markdownDescription": "Denies the rebuild_project_container command without any pre-configured scope."
         },
+        {
+          "description": "Denies the reconcile_aws_projects command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-reconcile-aws-projects",
+          "markdownDescription": "Denies the reconcile_aws_projects command without any pre-configured scope."
+        },
         {
           "description": "Denies the reconcile_project_statuses command without any pre-configured scope.",
           "type": "string",
@@ -1676,6 +1922,18 @@
           "const": "deny-regenerate-web-terminal-token",
           "markdownDescription": "Denies the regenerate_web_terminal_token command without any pre-configured scope."
         },
+        {
+          "description": "Denies the remove_aws_resources command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-remove-aws-resources",
+          "markdownDescription": "Denies the remove_aws_resources command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the remove_host_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-remove-host-connection",
+          "markdownDescription": "Denies the remove_host_connection command without any pre-configured scope."
+        },
         {
           "description": "Denies the remove_marketplace command without any pre-configured scope.",
           "type": "string",
@@ -1706,6 +1964,12 @@
           "const": "deny-rename-container-path",
           "markdownDescription": "Denies the rename_container_path command without any pre-configured scope."
         },
+        {
+          "description": "Denies the repair_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-repair-aws-environment",
+          "markdownDescription": "Denies the repair_aws_environment command without any pre-configured scope."
+        },
         {
           "description": "Denies the rollback_migration command without any pre-configured scope.",
           "type": "string",
@@ -1724,6 +1988,12 @@
           "const": "deny-run-scheduled-task-now",
           "markdownDescription": "Denies the run_scheduled_task_now command without any pre-configured scope."
         },
+        {
+          "description": "Denies the save_aws_admin_bundle command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-save-aws-admin-bundle",
+          "markdownDescription": "Denies the save_aws_admin_bundle command without any pre-configured scope."
+        },
         {
           "description": "Denies the save_note command without any pre-configured scope.",
           "type": "string",
@@ -1892,6 +2162,24 @@
           "const": "deny-uninstall-marketplace-item",
           "markdownDescription": "Denies the uninstall_marketplace_item command without any pre-configured scope."
         },
+        {
+          "description": "Denies the unlock_aws_state command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-unlock-aws-state",
+          "markdownDescription": "Denies the unlock_aws_state command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the update_aws_connection command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-update-aws-connection",
+          "markdownDescription": "Denies the update_aws_connection command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the update_aws_environment command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-update-aws-environment",
+          "markdownDescription": "Denies the update_aws_environment command without any pre-configured scope."
+        },
         {
           "description": "Denies the update_marketplace command without any pre-configured scope.",
           "type": "string",

app/src-tauri/src/auth_bridge/mod.rs

@@ -32,7 +32,7 @@
 //! |---|---|
 //! | Bridge disabled | `set_auth_bridge_enabled(false)` → [`AuthBridgeManager::stop`] |
 //! | Container stopped via UI | `stop_project_container` → [`AuthBridgeManager::stop`] |
-//! | Container stopped/died another way | poller's own `is_container_running` check → loop exits |
+//! | Container stopped/died another way | poller's own `is_running` check → loop exits |
 //! | Project deleted | `remove_project` → [`AuthBridgeManager::stop`]; also the poller's `store.get()` check |
 //! | Container rebuilt | `rebuild_project_container` → stop, then start re-arms it |
 //! | App exit | window `CloseRequested` → [`AuthBridgeManager::stop_all`] |
@@ -55,8 +55,7 @@ use tauri::{AppHandle, Emitter};
 use tokio::sync::{watch, Mutex};
 use tokio::task::JoinHandle;
 
-use crate::docker::container::is_container_running;
-use crate::docker::exec::{exec_oneshot_limited, PROC_NET_OUTPUT_LIMIT};
+use crate::host::{ContainerTarget, PROC_NET_OUTPUT_LIMIT};
 use crate::storage::projects_store::ProjectsStore;
 
 use proc_net::PortFamily;
@@ -178,7 +177,7 @@ impl AuthBridgeManager {
     pub async fn start(
         &self,
         project_id: String,
-        container_id: String,
+        container: ContainerTarget,
         app: AppHandle,
         store: Arc<ProjectsStore>,
     ) {
@@ -200,12 +199,12 @@ impl AuthBridgeManager {
         log::info!(
             "Auth bridge: starting for project {} (container {})",
             project_id,
-            &container_id[..container_id.len().min(12)]
+            &container.id()[..container.id().len().min(12)]
         );
 
         let poller = tokio::spawn(poll_loop(
             project_id.clone(),
-            container_id,
+            container,
             epoch,
             app,
             store,
@@ -276,7 +275,7 @@ impl AuthBridgeManager {
 #[allow(clippy::too_many_arguments)]
 async fn poll_loop(
     project_id: String,
-    container_id: String,
+    container: ContainerTarget,
     epoch: u64,
     app: AppHandle,
     store: Arc<ProjectsStore>,
@@ -301,7 +300,7 @@ async fn poll_loop(
             log::info!("Auth bridge: disabled for project {} — tearing down", project_id);
             break;
         }
-        if !is_container_running(&container_id).await.unwrap_or(false) {
+        if !container.is_running().await.unwrap_or(false) {
             log::info!(
                 "Auth bridge: container for project {} is no longer running — tearing down",
                 project_id
@@ -327,7 +326,8 @@ async fn poll_loop(
         // bridge or stopping the container doesn't wait out an in-flight poll.
         let discovery = tokio::select! {
             _ = cancel.changed() => break,
-            res = exec_oneshot_limited(&container_id, "claude", cmd, PROC_NET_OUTPUT_LIMIT) => {
+            // Background: on AWS this poll must not keep an idle workspace up.
+            res = container.exec_oneshot_background("claude", cmd, PROC_NET_OUTPUT_LIMIT) => {
                 res.map(|(out, _)| out)
             }
         };
@@ -340,7 +340,7 @@ async fn poll_loop(
                 // gateway/STT/web-terminal ports can be re-pointed while the
                 // bridge is running, and a stale reservation set is a hole.
                 let skip = skipped_ports(&project, &store.list(), &app_settings(&app));
-                if reconcile(&container_id, &discovered, &skip, &state).await {
+                if reconcile(&container, &discovered, &skip, &state).await {
                     emit_status(&app, &project_id, &state, true).await;
                 }
             }
@@ -530,7 +530,7 @@ const MAX_CONFLICTS: usize = 32;
 /// Bring the set of host listeners in line with what the container is currently
 /// listening on. Returns whether anything the UI cares about changed.
 async fn reconcile(
-    container_id: &str,
+    container: &ContainerTarget,
     discovered: &BTreeMap<u16, PortFamily>,
     skip: &HashSet<u16>,
     state: &Arc<Mutex<BridgeState>>,
@@ -583,7 +583,7 @@ async fn reconcile(
             );
             continue;
         }
-        match PortForward::bind(container_id.to_string(), port, family).await {
+        match PortForward::bind(container.clone(), port, family).await {
             Ok(forward) => {
                 if st.conflicts.remove(&port).is_some() {
                     log::info!("Auth bridge: host port {} became available", port);
@@ -833,7 +833,13 @@ mod tests {
             (45000u16..45200).map(|p| (p, PortFamily::V4)).collect();
         let state = Arc::new(Mutex::new(BridgeState::default()));
 
-        reconcile("no-such-container", &discovered, &HashSet::new(), &state).await;
+        reconcile(
+            &ContainerTarget::docker("no-such-container"),
+            &discovered,
+            &HashSet::new(),
+            &state,
+        )
+        .await;
 
         let mut st = state.lock().await;
         assert!(

app/src-tauri/src/auth_bridge/tunnel.rs

@@ -11,7 +11,7 @@
 //! and stdout wired to the TCP socket. `socat` ships in the container image.
 //!
 //! The exec plumbing itself is *not* reimplemented here: it comes from
-//! [`crate::docker::exec::create_attached_exec`], the same helper the
+//! [`crate::host::ContainerTarget::attach_exec`], the same helper the
 //! interactive terminal sessions are built on.
 //!
 //! ## What the host listener is, and is not
@@ -56,14 +56,12 @@
 use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr};
 use std::time::Duration;
 
-use bollard::container::LogOutput;
+use crate::host::{AttachedExec, ContainerTarget, ExecChunk};
 use futures_util::StreamExt;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::{TcpListener, TcpStream};
 use tokio::task::{JoinHandle, JoinSet};
 
-use crate::docker::exec::{create_attached_exec, AttachedExec};
-
 use super::proc_net::PortFamily;
 
 /// Buffer size for the host→container direction. OAuth callbacks are tiny; this
@@ -143,13 +141,13 @@ impl Drop for PortForward {
 }
 
 impl PortForward {
-    /// Bind `port` on the host loopback and start proxying into `container_id`.
+    /// Bind `port` on the host loopback and start proxying into `container`.
     ///
     /// The bind happens before the task is spawned, so an already-taken port is
     /// reported to the caller as an error rather than disappearing into a
     /// background task.
     pub async fn bind(
-        container_id: String,
+        container: ContainerTarget,
         port: u16,
         family: PortFamily,
     ) -> Result<Self, std::io::Error> {
@@ -196,7 +194,7 @@ impl PortForward {
             };
 
         let target = family.socat_target(port);
-        let task = tokio::spawn(accept_loop(container_id, port, target, v4, v6));
+        let task = tokio::spawn(accept_loop(container, port, target, v4, v6));
 
         Ok(Self {
             port,
@@ -219,7 +217,7 @@ impl PortForward {
 /// Accept on both loopback listeners until aborted. Dropping this future drops
 /// the listeners (freeing the port) and the `JoinSet` (aborting live tunnels).
 async fn accept_loop(
-    container_id: String,
+    container: ContainerTarget,
     port: u16,
     target: String,
     v4: TcpListener,
@@ -258,7 +256,7 @@ async fn accept_loop(
                 log::debug!("Auth bridge: connection from {} to bridged port {}", peer, port);
                 let _ = stream.set_nodelay(true);
                 conns.spawn(tunnel_connection(
-                    container_id.clone(),
+                    container.clone(),
                     target.clone(),
                     stream,
                     port,
@@ -288,7 +286,12 @@ async fn accept_optional(
 ///
 /// Nothing is forwarded until that decision is made, so a refused request never
 /// reaches the container at all — not even a `docker exec`.
-async fn tunnel_connection(container_id: String, target: String, mut stream: TcpStream, port: u16) {
+async fn tunnel_connection(
+    container: ContainerTarget,
+    target: String,
+    mut stream: TcpStream,
+    port: u16,
+) {
     let head = match read_leading_bytes(&mut stream).await {
         Ok(head) => head,
         Err(e) => {
@@ -319,7 +322,7 @@ async fn tunnel_connection(container_id: String, target: String, mut stream: Tcp
     }
 
     // The bytes already off the socket go back on the wire first, byte-exact.
-    tunnel_connection_with_prelude(container_id, target, stream, port, head.into_buffer()).await
+    tunnel_connection_with_prelude(container, target, stream, port, head.into_buffer()).await
 }
 
 /// What the first bytes of an accepted connection turned out to be.
@@ -512,7 +515,7 @@ pub(crate) fn web_request_verdict(head: &str) -> Verdict {
 /// back on the wire. Passing them here keeps the byte stream exact, rather than
 /// re-serialising a parsed request.
 pub async fn tunnel_connection_with_prelude(
-    container_id: String,
+    container: ContainerTarget,
     target: String,
     stream: TcpStream,
     port: u16,
@@ -524,7 +527,7 @@ pub async fn tunnel_connection_with_prelude(
         mut output,
         mut input,
         ..
-    } = match create_attached_exec(&container_id, cmd, false).await {
+    } = match container.attach_exec(cmd, false).await {
         Ok(e) => e,
         Err(e) => {
             log::warn!(
@@ -587,12 +590,12 @@ pub async fn tunnel_connection_with_prelude(
             // Only stdout is payload. The exec is created with tty = false
             // precisely so Docker demultiplexes these, keeping socat's stderr
             // diagnostics out of the proxied byte stream.
-            Ok(LogOutput::StdOut { message }) => {
+            Ok(ExecChunk::StdOut(message)) => {
                 if host_tx.write_all(&message).await.is_err() {
                     break;
                 }
             }
-            Ok(LogOutput::StdErr { message }) => {
+            Ok(ExecChunk::StdErr(message)) => {
                 log::debug!(
                     "Auth bridge: socat stderr for port {}: {}",
                     port,

app/src-tauri/src/aws/connection.rs

@@ -0,0 +1,332 @@
+//! An `SdkConfig` built from a saved `HostConnection`, never from the
+//! process's default credentials chain.
+
+use aws_config::identity::IdentityCache;
+use aws_config::profile::ProfileFileCredentialsProvider;
+use aws_config::provider_config::ProviderConfig;
+use aws_config::retry::RetryConfig;
+use aws_config::timeout::TimeoutConfig;
+use aws_config::{BehaviorVersion, Region, SdkConfig};
+use aws_credential_types::provider::error::CredentialsError;
+use aws_credential_types::provider::{future, ProvideCredentials, SharedCredentialsProvider};
+use aws_credential_types::Credentials;
+use aws_runtime::env_config::file::EnvConfigFiles;
+use aws_smithy_async::rt::sleep::default_async_sleep;
+use aws_smithy_async::time::SharedTimeSource;
+
+use super::error::{AwsError, ProfileCredentialsError};
+use crate::models::host_connection::{AwsAuth, HostConnection, HostKind};
+use crate::storage::secure;
+
+/// The SDK config for `conn` in `region`. Credentials are resolved lazily,
+/// so a missing profile or an expired SSO session surfaces on the first
+/// call and is classified there (`classify_sdk_error`).
+pub async fn sdk_config(conn: &HostConnection, region: &str) -> Result<SdkConfig, AwsError> {
+    sdk_config_with(conn, region, None).await
+}
+
+/// `sdk_config` with the profile files overridden (tests pass temp files so
+/// neither the process environment nor `~/.aws` is consulted).
+pub(crate) async fn sdk_config_with(
+    conn: &HostConnection,
+    region: &str,
+    profile_files: Option<EnvConfigFiles>,
+) -> Result<SdkConfig, AwsError> {
+    let HostKind::Aws { auth, .. } = &conn.kind;
+    let region = Region::new(region.to_string());
+    let credentials = match auth {
+        AwsAuth::Profile { name } => {
+            // The profile is read for credentials only (static keys, SSO,
+            // assume-role, credential_process), never for endpoints or
+            // service settings.
+            let mut builder = ProfileFileCredentialsProvider::builder()
+                .configure(&ProviderConfig::default().with_region(Some(region.clone())))
+                .profile_name(name);
+            if let Some(files) = profile_files {
+                builder = builder.profile_files(files);
+            }
+            SharedCredentialsProvider::new(NamedProfileProvider {
+                profile: name.clone(),
+                inner: builder.build(),
+            })
+        }
+        AwsAuth::Keys { keyring_ref } => {
+            let keys = secure::get_aws_keys(keyring_ref)
+                .map_err(|message| AwsError::Other { message })?
+                .ok_or(AwsError::KeysMissing)?;
+            keys_credentials(&keys)
+        }
+    };
+    Ok(build_sdk_config(region, credentials))
+}
+
+/// The SDK config for keys not yet saved (the add-connection check runs
+/// before anything touches the keychain).
+pub fn sdk_config_for_keys(keys: &secure::AwsKeys, region: &str) -> SdkConfig {
+    build_sdk_config(Region::new(region.to_string()), keys_credentials(keys))
+}
+
+fn keys_credentials(keys: &secure::AwsKeys) -> SharedCredentialsProvider {
+    SharedCredentialsProvider::new(Credentials::new(
+        keys.access_key_id.as_str(),
+        keys.secret_access_key.as_str(),
+        keys.session_token.clone(),
+        None,
+        "triple-c-connection",
+    ))
+}
+
+/// Built by hand rather than with `aws_config::defaults(..).load()`, which
+/// would read `AWS_ENDPOINT_URL[_<SERVICE>]`, FIPS/dual-stack, retry and
+/// other settings from the process environment and the default profile. A
+/// stray endpoint there would send every connection's signed requests (and
+/// the permission check) somewhere other than AWS. Connections talk to the
+/// real regional endpoints; a profile's own `endpoint_url` is ignored too.
+/// The HTTP client and stalled-stream protection are each service client's
+/// defaults (the `default-https-client` stack every AWS crate here is built
+/// with). Timeouts are ours: [`OPERATION_TIMEOUT`] / [`ATTEMPT_TIMEOUT`].
+fn build_sdk_config(region: Region, credentials: SharedCredentialsProvider) -> SdkConfig {
+    let mut builder = SdkConfig::builder()
+        .behavior_version(BehaviorVersion::latest())
+        .region(region)
+        .credentials_provider(credentials)
+        .identity_cache(IdentityCache::lazy().build())
+        .retry_config(RetryConfig::standard())
+        .timeout_config(timeouts())
+        .time_source(SharedTimeSource::default());
+    if let Some(sleep) = default_async_sleep() {
+        builder = builder.sleep_impl(sleep);
+    }
+    builder.build()
+}
+
+/// Every call the app makes through the SDK is a control-plane call with a
+/// small answer (ECS, Secrets Manager, EFS, IAM, SSM, CloudWatch Logs, STS,
+/// and S3 reads of state objects capped at 2 KiB); OpenTofu talks to AWS
+/// itself, not through these clients. Without a bound a half-open
+/// connection would hang a start, a stop or the death watch for minutes.
+/// The operation bound covers every retry; the attempt bound is one try.
+pub const OPERATION_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(30);
+pub const ATTEMPT_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
+
+fn timeouts() -> TimeoutConfig {
+    TimeoutConfig::builder()
+        .operation_timeout(OPERATION_TIMEOUT)
+        .operation_attempt_timeout(ATTEMPT_TIMEOUT)
+        .build()
+}
+
+/// Puts the profile's name into the source chain of every credentials error,
+/// so a failure deep inside the SDK can be reported against the profile.
+#[derive(Debug)]
+struct NamedProfileProvider {
+    profile: String,
+    inner: ProfileFileCredentialsProvider,
+}
+
+impl NamedProfileProvider {
+    async fn load(&self) -> Result<Credentials, CredentialsError> {
+        self.inner.provide_credentials().await.map_err(|e| {
+            let not_loaded = matches!(e, CredentialsError::CredentialsNotLoaded(_));
+            let timed_out = matches!(e, CredentialsError::ProviderTimedOut(_));
+            if timed_out {
+                return e;
+            }
+            let invalid = matches!(e, CredentialsError::InvalidConfiguration(_));
+            let wrapped = ProfileCredentialsError {
+                profile: self.profile.clone(),
+                not_loaded,
+                source: e,
+            };
+            // Keep the error's kind; only its context changes.
+            if not_loaded {
+                CredentialsError::not_loaded(wrapped)
+            } else if invalid {
+                CredentialsError::invalid_configuration(wrapped)
+            } else {
+                CredentialsError::provider_error(wrapped)
+            }
+        })
+    }
+}
+
+impl ProvideCredentials for NamedProfileProvider {
+    fn provide_credentials<'a>(&'a self) -> future::ProvideCredentials<'a>
+    where
+        Self: 'a,
+    {
+        future::ProvideCredentials::new(self.load())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::aws::identity::caller_identity;
+    use crate::aws::AwsError;
+    use crate::models::host_connection::{AwsAuth, HostConnection, HostKind};
+    use aws_runtime::env_config::file::{EnvConfigFileKind, EnvConfigFiles};
+
+    fn profile_conn(name: &str) -> HostConnection {
+        HostConnection {
+            id: "c1".into(),
+            name: "Test".into(),
+            kind: HostKind::Aws {
+                auth: AwsAuth::Profile { name: name.into() },
+                default_region: "us-west-2".into(),
+            },
+        }
+    }
+
+    /// Empty config and credentials files, passed explicitly so neither the
+    /// process environment nor ~/.aws is consulted.
+    #[tokio::test]
+    async fn a_missing_profile_is_reported_by_name() {
+        let dir = tempfile::tempdir().unwrap();
+        let config = dir.path().join("config");
+        let creds = dir.path().join("credentials");
+        std::fs::write(&config, "").unwrap();
+        std::fs::write(&creds, "").unwrap();
+        let files = EnvConfigFiles::builder()
+            .include_default_config_file(false)
+            .include_default_credentials_file(false)
+            .with_file(EnvConfigFileKind::Config, &config)
+            .with_file(EnvConfigFileKind::Credentials, &creds)
+            .build();
+        let cfg = sdk_config_with(&profile_conn("nope"), "us-west-2", Some(files))
+            .await
+            .unwrap();
+        let err = caller_identity(&cfg).await.unwrap_err();
+        assert_eq!(
+            err,
+            AwsError::ProfileNotFound {
+                profile: "nope".into()
+            }
+        );
+    }
+
+    /// A profile that the files do define but under another name is still
+    /// "not found" for the name the connection asked for.
+    #[tokio::test]
+    async fn a_profile_absent_from_populated_files_is_reported_by_name() {
+        let dir = tempfile::tempdir().unwrap();
+        let config = dir.path().join("config");
+        std::fs::write(
+            &config,
+            "[profile other]\naws_access_key_id = AKIDTEST\naws_secret_access_key = s\n",
+        )
+        .unwrap();
+        let files = EnvConfigFiles::builder()
+            .include_default_config_file(false)
+            .include_default_credentials_file(false)
+            .with_file(EnvConfigFileKind::Config, &config)
+            .build();
+        let cfg = sdk_config_with(&profile_conn("nope"), "us-west-2", Some(files))
+            .await
+            .unwrap();
+        let err = caller_identity(&cfg).await.unwrap_err();
+        assert_eq!(
+            err,
+            AwsError::ProfileNotFound {
+                profile: "nope".into()
+            }
+        );
+    }
+
+    #[tokio::test]
+    async fn the_region_comes_from_the_argument() {
+        let dir = tempfile::tempdir().unwrap();
+        let config = dir.path().join("config");
+        std::fs::write(&config, "[profile p]\nregion = eu-west-1\n").unwrap();
+        let files = EnvConfigFiles::builder()
+            .include_default_config_file(false)
+            .include_default_credentials_file(false)
+            .with_file(EnvConfigFileKind::Config, &config)
+            .build();
+        let cfg = sdk_config_with(&profile_conn("p"), "ap-south-1", Some(files))
+            .await
+            .unwrap();
+        assert_eq!(cfg.region().map(|r| r.as_ref()), Some("ap-south-1"));
+    }
+
+    /// Config files that try to redirect every call. A connection always
+    /// talks to the real regional AWS endpoints, so none of this may reach
+    /// the config: not the named profile's `endpoint_url`, not `[default]`'s,
+    /// not a per-service `services` section.
+    const REDIRECTING_CONFIG: &str = "[default]
+endpoint_url = http://127.0.0.1:9
+retry_mode = adaptive
+max_attempts = 9
+use_fips_endpoint = true
+
+[profile p]
+endpoint_url = http://127.0.0.1:9
+retry_mode = adaptive
+max_attempts = 9
+use_dualstack_endpoint = true
+services = redirect
+aws_access_key_id = AKIDTEST
+aws_secret_access_key = s
+
+[services redirect]
+sts =
+  endpoint_url = http://127.0.0.1:9
+";
+
+    fn assert_isolated(cfg: &aws_config::SdkConfig) {
+        assert_eq!(cfg.endpoint_url(), None);
+        assert!(
+            cfg.service_config().is_none(),
+            "service config loaded from env/profile"
+        );
+        assert_eq!(cfg.use_fips(), None);
+        assert_eq!(cfg.use_dual_stack(), None);
+        let retry = cfg.retry_config().expect("retry config");
+        assert_eq!(retry.mode(), aws_config::retry::RetryMode::Standard);
+        assert_eq!(retry.max_attempts(), 3);
+        assert_eq!(cfg.region().map(|r| r.as_ref()), Some("us-west-2"));
+    }
+
+    #[tokio::test]
+    async fn a_profile_connection_ignores_endpoint_and_service_settings_in_the_profile() {
+        let dir = tempfile::tempdir().unwrap();
+        let config = dir.path().join("config");
+        std::fs::write(&config, REDIRECTING_CONFIG).unwrap();
+        let files = EnvConfigFiles::builder()
+            .include_default_config_file(false)
+            .include_default_credentials_file(false)
+            .with_file(EnvConfigFileKind::Config, &config)
+            .build();
+        let cfg = sdk_config_with(&profile_conn("p"), "us-west-2", Some(files))
+            .await
+            .unwrap();
+        assert_isolated(&cfg);
+    }
+
+    /// The keys arm reads no files or environment at all: same isolation.
+    #[test]
+    fn a_keys_connection_config_is_isolated() {
+        let keys = crate::storage::secure::AwsKeys {
+            access_key_id: "AKIDTEST".into(),
+            secret_access_key: "s".into(),
+            session_token: None,
+        };
+        let cfg = build_sdk_config(Region::new("us-west-2"), keys_credentials(&keys));
+        assert_isolated(&cfg);
+        assert!(cfg.credentials_provider().is_some());
+    }
+
+    #[test]
+    fn every_sdk_call_is_bounded() {
+        let keys = crate::storage::secure::AwsKeys {
+            access_key_id: "AKIDTEST".into(),
+            secret_access_key: "s".into(),
+            session_token: None,
+        };
+        let cfg = build_sdk_config(Region::new("us-west-2"), keys_credentials(&keys));
+        let t = cfg.timeout_config().expect("a timeout config");
+        assert_eq!(t.operation_timeout(), Some(OPERATION_TIMEOUT));
+        assert_eq!(t.operation_attempt_timeout(), Some(ATTEMPT_TIMEOUT));
+        assert!(ATTEMPT_TIMEOUT < OPERATION_TIMEOUT);
+    }
+}

app/src-tauri/src/aws/error.rs

@@ -0,0 +1,164 @@
+//! What can go wrong talking to AWS, in the terms the UI acts on.
+
+use std::error::Error;
+
+use aws_sdk_sts::error::{DisplayErrorContext, ErrorMetadata};
+use serde::Serialize;
+
+#[derive(Debug, Clone, Serialize, PartialEq, Eq)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum AwsError {
+    /// The UI offers "Sign in".
+    SsoExpired {
+        profile: String,
+    },
+    ProfileNotFound {
+        profile: String,
+    },
+    /// The keychain entry for a keys connection is gone.
+    KeysMissing,
+    InvalidCredentials {
+        message: String,
+    },
+    AccessDenied {
+        action: String,
+        message: String,
+    },
+    /// `s3:CreateBucket` said `BucketAlreadyExists`: the state bucket's
+    /// name belongs to another AWS account. Never treated as success.
+    StateBucketTaken {
+        bucket: String,
+    },
+    /// An account limit (Fargate vCPUs, tasks, ...) refused the request.
+    /// Never retried; `message` says what to do.
+    QuotaExceeded {
+        message: String,
+    },
+    Other {
+        message: String,
+    },
+}
+
+impl std::fmt::Display for AwsError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            AwsError::SsoExpired { profile } if profile.is_empty() => {
+                write!(f, "The AWS SSO session has expired; sign in again")
+            }
+            AwsError::SsoExpired { profile } => write!(
+                f,
+                "The AWS SSO session for profile \"{profile}\" has expired; sign in again"
+            ),
+            AwsError::ProfileNotFound { profile } => write!(
+                f,
+                "AWS profile \"{profile}\" was not found, or has no credentials, in the AWS config and credentials files"
+            ),
+            AwsError::KeysMissing => write!(
+                f,
+                "The access keys for this connection are no longer in the system keychain; enter them again"
+            ),
+            AwsError::InvalidCredentials { message } => {
+                write!(f, "AWS rejected the credentials: {message}")
+            }
+            AwsError::AccessDenied { action, message } => {
+                write!(f, "Access denied for {action}: {message}")
+            }
+            AwsError::StateBucketTaken { bucket } => write!(
+                f,
+                "The state bucket name \"{bucket}\" is already taken by another AWS account, so \
+                 Triple-C can't keep OpenTofu state there"
+            ),
+            AwsError::QuotaExceeded { message } | AwsError::Other { message } => {
+                f.write_str(message)
+            }
+        }
+    }
+}
+
+/// Carried in the source chain of every credentials error from a profile
+/// connection, so classification knows which profile failed and whether it
+/// produced no credentials at all (absent, or present without credentials).
+#[derive(Debug)]
+pub(crate) struct ProfileCredentialsError {
+    pub profile: String,
+    pub not_loaded: bool,
+    pub source: aws_credential_types::provider::error::CredentialsError,
+}
+
+impl std::fmt::Display for ProfileCredentialsError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "credentials for profile `{}`", self.profile)
+    }
+}
+
+impl Error for ProfileCredentialsError {
+    fn source(&self) -> Option<&(dyn Error + 'static)> {
+        Some(&self.source)
+    }
+}
+
+const SSO_EXPIRED: &[&str] = &[
+    "The SSO session associated with this profile has expired",
+    "Token has expired",
+    "the SSO token has expired",
+];
+const SSO_REVOKED: &[&str] = &[
+    "UnauthorizedException",
+    "Session token not found or invalid",
+];
+const DENIED_CODES: &[&str] = &[
+    "AccessDeniedException",
+    "AccessDenied",
+    "UnauthorizedOperation",
+];
+const BAD_CREDENTIAL_CODES: &[&str] = &[
+    "ExpiredToken",
+    "InvalidClientTokenId",
+    "SignatureDoesNotMatch",
+    "UnrecognizedClientException",
+];
+
+/// Classify any SDK error (an `SdkError`, a credentials error, ...) from
+/// calling `action` (e.g. `iam:GetRole`). Matching is on the full display
+/// chain, which carries both provider messages and service error codes.
+pub fn classify_sdk_error(action: &str, err: &(dyn Error + 'static)) -> AwsError {
+    let text = DisplayErrorContext(err).to_string();
+    let mut chain = std::iter::successors(Some(err), |e| (*e).source());
+    let profile = chain
+        .clone()
+        .find_map(|e| e.downcast_ref::<ProfileCredentialsError>());
+    // The service's own message, when one is in the chain.
+    let service_message = chain
+        .find_map(|e| e.downcast_ref::<ErrorMetadata>())
+        .and_then(|m| m.message())
+        .map(str::to_string);
+    let message = service_message.unwrap_or_else(|| text.clone());
+
+    if SSO_EXPIRED.iter().any(|s| text.contains(s)) {
+        return AwsError::SsoExpired {
+            profile: profile.map(|p| p.profile.clone()).unwrap_or_default(),
+        };
+    }
+    // SSO's GetRoleCredentials on a revoked or signed-out session. Only
+    // inside a profile's credentials: other services use this code too.
+    if let Some(p) = profile.filter(|_| SSO_REVOKED.iter().any(|s| text.contains(s))) {
+        return AwsError::SsoExpired {
+            profile: p.profile.clone(),
+        };
+    }
+    if let Some(p) = profile.filter(|p| p.not_loaded) {
+        return AwsError::ProfileNotFound {
+            profile: p.profile.clone(),
+        };
+    }
+    if DENIED_CODES.iter().any(|c| text.contains(c)) {
+        return AwsError::AccessDenied {
+            action: action.to_string(),
+            message,
+        };
+    }
+    if BAD_CREDENTIAL_CODES.iter().any(|c| text.contains(c)) {
+        return AwsError::InvalidCredentials { message };
+    }
+    AwsError::Other { message: text }
+}

app/src-tauri/src/aws/identity.rs

@@ -0,0 +1,413 @@
+//! Who the connection's credentials are, and which IAM principal the
+//! policy simulator should be asked about.
+
+use aws_config::SdkConfig;
+use serde::Serialize;
+
+use super::error::{classify_sdk_error, AwsError};
+
+#[derive(Debug, Clone, Serialize, PartialEq, Eq)]
+pub struct CallerIdentity {
+    pub account: String,
+    pub arn: String,
+    /// STS `UserId`: the principal's unique id (for a role session,
+    /// `<role id>:<session name>`).
+    pub user_id: String,
+}
+
+/// `sts:GetCallerIdentity`, which needs no IAM permission: it is the
+/// connection test itself.
+pub async fn caller_identity(cfg: &SdkConfig) -> Result<CallerIdentity, AwsError> {
+    const ACTION: &str = "sts:GetCallerIdentity";
+    let out = aws_sdk_sts::Client::new(cfg)
+        .get_caller_identity()
+        .send()
+        .await
+        .map_err(|e| classify_sdk_error(ACTION, &e))?;
+    let field = |v: Option<&str>, name: &str| {
+        v.map(str::to_string).ok_or_else(|| AwsError::Other {
+            message: format!("{ACTION} returned no {name}"),
+        })
+    };
+    Ok(CallerIdentity {
+        account: field(out.account(), "Account")?,
+        arn: field(out.arn(), "Arn")?,
+        user_id: field(out.user_id(), "UserId")?,
+    })
+}
+
+/// The principal to simulate, as far as the caller's ARN tells us.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PrincipalArn {
+    /// An IAM user or role ARN, usable as `PolicySourceArn` directly.
+    Exact(String),
+    /// A role session: the role's ARN carries a path the session ARN lacks,
+    /// so it has to be looked up (`resolve_principal`).
+    AssumedRole { account: String, role_name: String },
+}
+
+/// Map the caller's ARN to a simulatable principal. Root, federated users
+/// and anything unrecognised cannot be simulated; the caller falls back to
+/// probing instead.
+pub fn principal_for_simulation(caller_arn: &str) -> Result<PrincipalArn, AwsError> {
+    let unsupported = || AwsError::Other {
+        message: format!("IAM policy simulation isn't possible for the principal {caller_arn}"),
+    };
+    // arn:<partition>:<service>:<region>:<account>:<resource>
+    let mut parts = caller_arn.splitn(6, ':');
+    let (Some("arn"), Some(partition), Some(service), Some(_region), Some(account), Some(resource)) = (
+        parts.next(),
+        parts.next(),
+        parts.next(),
+        parts.next(),
+        parts.next(),
+        parts.next(),
+    ) else {
+        return Err(unsupported());
+    };
+    if partition.is_empty() || account.is_empty() {
+        return Err(unsupported());
+    }
+    match service {
+        "iam" if resource.starts_with("user/") || resource.starts_with("role/") => {
+            Ok(PrincipalArn::Exact(caller_arn.to_string()))
+        }
+        "sts" => match resource
+            .strip_prefix("assumed-role/")
+            .and_then(|r| r.split_once('/'))
+        {
+            Some((role_name, _session)) if !role_name.is_empty() => Ok(PrincipalArn::AssumedRole {
+                account: account.to_string(),
+                role_name: role_name.to_string(),
+            }),
+            _ => Err(unsupported()),
+        },
+        _ => Err(unsupported()),
+    }
+}
+
+/// The full ARN to simulate. An assumed role needs `iam:GetRole` to recover
+/// the role's path (SSO roles live under `/aws-reserved/...`).
+pub async fn resolve_principal(
+    iam: &aws_sdk_iam::Client,
+    p: PrincipalArn,
+) -> Result<String, AwsError> {
+    const ACTION: &str = "iam:GetRole";
+    let (account, role_name) = match p {
+        PrincipalArn::Exact(arn) => return Ok(arn),
+        PrincipalArn::AssumedRole { account, role_name } => (account, role_name),
+    };
+    let out = iam
+        .get_role()
+        .role_name(&role_name)
+        .send()
+        .await
+        .map_err(|e| classify_sdk_error(ACTION, &e))?;
+    let arn = out
+        .role()
+        .map(|r| r.arn().to_string())
+        .filter(|a| !a.is_empty())
+        .ok_or_else(|| AwsError::Other {
+            message: format!("{ACTION} returned no role for {role_name}"),
+        })?;
+    // The role must be the session's own: same account.
+    if arn.split(':').nth(4) != Some(account.as_str()) {
+        return Err(AwsError::Other {
+            message: format!("{ACTION} for {role_name} returned {arn}, outside account {account}"),
+        });
+    }
+    Ok(arn)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::aws::error::classify_sdk_error;
+    use crate::aws::AwsError;
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+    #[test]
+    fn iam_user_arn_is_used_as_is() {
+        let arn = "arn:aws:iam::111122223333:user/alice";
+        assert_eq!(
+            principal_for_simulation(arn).unwrap(),
+            PrincipalArn::Exact(arn.into())
+        );
+    }
+
+    #[test]
+    fn iam_role_arn_is_used_as_is() {
+        let arn = "arn:aws:iam::111122223333:role/ops/deployer";
+        assert_eq!(
+            principal_for_simulation(arn).unwrap(),
+            PrincipalArn::Exact(arn.into())
+        );
+    }
+
+    #[test]
+    fn assumed_role_arn_maps_to_role_name() {
+        let arn = "arn:aws:sts::111122223333:assumed-role/AWSReservedSSO_Admin_abc/alice@x.com";
+        assert_eq!(
+            principal_for_simulation(arn).unwrap(),
+            PrincipalArn::AssumedRole {
+                account: "111122223333".into(),
+                role_name: "AWSReservedSSO_Admin_abc".into(),
+            }
+        );
+    }
+
+    #[test]
+    fn root_and_federated_arns_are_rejected_for_simulation() {
+        for arn in [
+            "arn:aws:iam::1:root",
+            "arn:aws:sts::1:federated-user/bob",
+            "not-an-arn",
+        ] {
+            match principal_for_simulation(arn) {
+                Err(AwsError::Other { message }) => {
+                    assert!(
+                        message.contains("simulation isn't possible"),
+                        "{arn}: {message}"
+                    )
+                }
+                other => panic!("{arn}: expected Other, got {other:?}"),
+            }
+        }
+    }
+
+    /// A one-shot-per-connection HTTP server that answers every request with
+    /// `status` and `body`, and reports each request it saw.
+    async fn fake_endpoint(
+        status: &'static str,
+        body: &'static str,
+    ) -> (String, tokio::sync::mpsc::UnboundedReceiver<String>) {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let (tx, rx) = tokio::sync::mpsc::unbounded_channel::<String>();
+        tokio::spawn(async move {
+            loop {
+                let Ok((mut sock, _)) = listener.accept().await else {
+                    return;
+                };
+                let tx = tx.clone();
+                tokio::spawn(async move {
+                    let mut buf = vec![0u8; 64 * 1024];
+                    let mut req = Vec::new();
+                    loop {
+                        let n = match sock.read(&mut buf).await {
+                            Ok(0) | Err(_) => return,
+                            Ok(n) => n,
+                        };
+                        req.extend_from_slice(&buf[..n]);
+                        let text = String::from_utf8_lossy(&req).into_owned();
+                        let Some(head_end) = text.find("\r\n\r\n") else {
+                            continue;
+                        };
+                        let len = text[..head_end]
+                            .lines()
+                            .find_map(|l| {
+                                let (k, v) = l.split_once(':')?;
+                                k.eq_ignore_ascii_case("content-length")
+                                    .then(|| v.trim().parse::<usize>().ok())
+                                    .flatten()
+                            })
+                            .unwrap_or(0);
+                        if req.len() < head_end + 4 + len {
+                            continue;
+                        }
+                        let _ = tx.send(text);
+                        let resp = format!(
+                            "HTTP/1.1 {status}\r\nContent-Type: text/xml\r\nContent-Length: {}\r\n\r\n{body}",
+                            body.len()
+                        );
+                        let _ = sock.write_all(resp.as_bytes()).await;
+                        req.clear();
+                    }
+                });
+            }
+        });
+        (format!("http://127.0.0.1:{port}"), rx)
+    }
+
+    fn iam_client(endpoint: String) -> aws_sdk_iam::Client {
+        let conf = aws_sdk_iam::Config::builder()
+            .behavior_version(aws_sdk_iam::config::BehaviorVersion::latest())
+            .region(aws_sdk_iam::config::Region::new("us-east-1"))
+            .credentials_provider(aws_sdk_iam::config::Credentials::new(
+                "AKIDTEST", "secret", None, None, "test",
+            ))
+            .endpoint_url(endpoint)
+            .build();
+        aws_sdk_iam::Client::from_conf(conf)
+    }
+
+    const ROLE_ARN: &str = "arn:aws:iam::111122223333:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_Admin_abc";
+
+    #[tokio::test]
+    async fn assumed_role_arn_maps_to_role_arn_with_path() {
+        const BODY: &str = r#"<GetRoleResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">
+  <GetRoleResult>
+    <Role>
+      <Path>/aws-reserved/sso.amazonaws.com/us-west-2/</Path>
+      <RoleName>AWSReservedSSO_Admin_abc</RoleName>
+      <RoleId>AROAEXAMPLEID</RoleId>
+      <Arn>arn:aws:iam::111122223333:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_Admin_abc</Arn>
+      <CreateDate>2024-01-01T00:00:00Z</CreateDate>
+    </Role>
+  </GetRoleResult>
+  <ResponseMetadata><RequestId>req-1</RequestId></ResponseMetadata>
+</GetRoleResponse>"#;
+        let (endpoint, mut seen) = fake_endpoint("200 OK", BODY).await;
+        let p = PrincipalArn::AssumedRole {
+            account: "111122223333".into(),
+            role_name: "AWSReservedSSO_Admin_abc".into(),
+        };
+        let arn = resolve_principal(&iam_client(endpoint), p).await.unwrap();
+        assert_eq!(arn, ROLE_ARN);
+        let req = seen.recv().await.unwrap();
+        assert!(req.contains("Action=GetRole"), "{req}");
+        assert!(req.contains("RoleName=AWSReservedSSO_Admin_abc"), "{req}");
+    }
+
+    #[tokio::test]
+    async fn an_exact_principal_needs_no_lookup() {
+        // No endpoint answers: any request would fail the test.
+        let client = iam_client("http://127.0.0.1:9".into());
+        let arn = "arn:aws:iam::111122223333:user/alice";
+        let got = resolve_principal(&client, PrincipalArn::Exact(arn.into()))
+            .await
+            .unwrap();
+        assert_eq!(got, arn);
+    }
+
+    #[tokio::test]
+    async fn a_denied_get_role_is_access_denied_for_get_role() {
+        const BODY: &str = r#"<ErrorResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">
+  <Error>
+    <Type>Sender</Type>
+    <Code>AccessDenied</Code>
+    <Message>User: arn:aws:sts::111122223333:assumed-role/R/alice is not authorized to perform: iam:GetRole</Message>
+  </Error>
+  <RequestId>req-2</RequestId>
+</ErrorResponse>"#;
+        let (endpoint, _seen) = fake_endpoint("403 Forbidden", BODY).await;
+        let p = PrincipalArn::AssumedRole {
+            account: "111122223333".into(),
+            role_name: "R".into(),
+        };
+        match resolve_principal(&iam_client(endpoint), p).await {
+            Err(AwsError::AccessDenied { action, message }) => {
+                assert_eq!(action, "iam:GetRole");
+                assert!(
+                    message.contains("is not authorized to perform: iam:GetRole"),
+                    "{message}"
+                );
+            }
+            other => panic!("expected AccessDenied, got {other:?}"),
+        }
+    }
+
+    #[derive(Debug)]
+    struct Msg(&'static str, Option<Box<dyn std::error::Error + 'static>>);
+    impl std::fmt::Display for Msg {
+        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+            f.write_str(self.0)
+        }
+    }
+    impl std::error::Error for Msg {
+        fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+            self.1.as_deref()
+        }
+    }
+
+    #[test]
+    fn an_expired_sso_token_is_reported_as_sso_expired() {
+        for leaf in [
+            "The SSO session associated with this profile has expired or is otherwise invalid",
+            "Token has expired and refresh failed",
+        ] {
+            // Deep in the chain, as the SDK reports it.
+            let err = Msg("dispatch failure", Some(Box::new(Msg(leaf, None))));
+            assert!(
+                matches!(
+                    classify_sdk_error("sts:GetCallerIdentity", &err),
+                    AwsError::SsoExpired { .. }
+                ),
+                "{leaf}"
+            );
+        }
+    }
+
+    /// SSO's GetRoleCredentials on a revoked or signed-out session. Inside a
+    /// profile connection's credentials that means "sign in again".
+    #[test]
+    fn a_revoked_sso_session_is_reported_as_sso_expired() {
+        use crate::aws::error::ProfileCredentialsError;
+        use aws_credential_types::provider::error::CredentialsError;
+        let leaf = CredentialsError::provider_error(
+            "service error: unhandled error (UnauthorizedException): Session token not found or invalid",
+        );
+        let err = CredentialsError::provider_error(ProfileCredentialsError {
+            profile: "dev".into(),
+            not_loaded: false,
+            source: leaf,
+        });
+        assert_eq!(
+            classify_sdk_error(
+                "sts:GetCallerIdentity",
+                &Msg("dispatch failure", Some(Box::new(err)))
+            ),
+            AwsError::SsoExpired {
+                profile: "dev".into()
+            }
+        );
+    }
+
+    /// The same error code from some other service, outside any profile's
+    /// credentials, is not an SSO problem.
+    #[test]
+    fn an_unauthorized_exception_outside_profile_credentials_is_not_sso() {
+        let err = Msg(
+            "service error: unhandled error (UnauthorizedException): Session token not found or invalid",
+            None,
+        );
+        assert!(!matches!(
+            classify_sdk_error("ecs:ListClusters", &err),
+            AwsError::SsoExpired { .. }
+        ));
+    }
+
+    #[test]
+    fn service_error_codes_are_classified() {
+        let denied = Msg(
+            "service error: unhandled error (AccessDeniedException)",
+            None,
+        );
+        assert!(matches!(
+            classify_sdk_error("ecs:ListClusters", &denied),
+            AwsError::AccessDenied { action, .. } if action == "ecs:ListClusters"
+        ));
+        for code in [
+            "ExpiredToken",
+            "InvalidClientTokenId",
+            "SignatureDoesNotMatch",
+        ] {
+            let text: &'static str =
+                Box::leak(format!("service error: unhandled error ({code})").into_boxed_str());
+            assert!(
+                matches!(
+                    classify_sdk_error("sts:GetCallerIdentity", &Msg(text, None)),
+                    AwsError::InvalidCredentials { .. }
+                ),
+                "{code}"
+            );
+        }
+        assert!(matches!(
+            classify_sdk_error(
+                "sts:GetCallerIdentity",
+                &Msg("io error: connection refused", None)
+            ),
+            AwsError::Other { .. }
+        ));
+    }
+}

app/src-tauri/src/aws/mod.rs

@@ -0,0 +1,24 @@
+//! AWS connection plumbing: an SDK config built from a saved
+//! `HostConnection`, the caller's identity, the tier policies and the
+//! permission check.
+//!
+
+mod connection;
+pub mod environments;
+mod error;
+mod identity;
+#[cfg(test)]
+mod live_tests;
+pub mod permissions;
+pub mod policies;
+#[cfg(test)]
+mod policy_eval;
+pub mod runtime;
+pub mod tasks;
+pub mod tofu;
+pub mod tofu_modules;
+pub mod workspace;
+
+pub use connection::{sdk_config, sdk_config_for_keys};
+pub use error::{classify_sdk_error, AwsError};
+pub use identity::{caller_identity, CallerIdentity};

app/src-tauri/src/aws/permissions.rs

@@ -0,0 +1,560 @@
+//! The permission check: which Triple-C tier the connection's credentials
+//! can act as, by simulating each tier's checks (`policies::checks`) with
+//! IAM's policy simulator, or — when the caller may not simulate itself —
+//! by a few read-only probes.
+
+use std::future::Future;
+
+use futures_util::stream::{self, StreamExt, TryStreamExt};
+use serde::Serialize;
+
+use super::error::{classify_sdk_error, AwsError};
+use super::identity::{self, principal_for_simulation, CallerIdentity, PrincipalArn};
+use super::policies::{checks, render, Check, ContextValue, Placeholders, Tier};
+
+/// How many simulations are in flight at once.
+const CONCURRENCY: usize = 2;
+
+/// One `SimulatePrincipalPolicy` request, fully rendered.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SimulationRequest {
+    pub principal: String,
+    pub action: String,
+    pub resource: String,
+    pub context: Vec<ContextEntry>,
+}
+
+/// A context key with every value it carries in the request.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ContextEntry {
+    pub key: String,
+    pub values: Vec<String>,
+}
+
+impl ContextEntry {
+    /// Sent as `StringList` when the key has more than one value, `String`
+    /// otherwise.
+    pub fn is_list(&self) -> bool {
+        self.values.len() > 1
+    }
+}
+
+/// Builds the simulation for `check`: the resource and every literal context
+/// value rendered with `p`, `OwnerId` as `user_id`, and `aws:userid` =
+/// `user_id` added. A key appearing more than once becomes one entry holding
+/// all its values (in order, without duplicates).
+pub fn simulation_request(check: &Check, p: &Placeholders, user_id: &str) -> SimulationRequest {
+    let mut context: Vec<ContextEntry> = Vec::new();
+    let mut add = |key: &str, value: String| match context.iter_mut().find(|e| e.key == key) {
+        Some(e) if e.values.contains(&value) => {}
+        Some(e) => e.values.push(value),
+        None => context.push(ContextEntry {
+            key: key.to_string(),
+            values: vec![value],
+        }),
+    };
+    for (key, value) in check.context {
+        let value = match value {
+            ContextValue::OwnerId => user_id.to_string(),
+            ContextValue::Literal(template) => render(template, p),
+        };
+        add(key, value);
+    }
+    add("aws:userid", user_id.to_string());
+    SimulationRequest {
+        principal: p.principal.to_string(),
+        action: check.action.to_string(),
+        resource: render(check.resource, p),
+        context,
+    }
+}
+
+/// The read-only calls used when simulation isn't possible.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum Probe {
+    EcsListClusters,
+    SsmGetParametersByPath,
+    SecretsListSecrets,
+}
+
+impl Probe {
+    const ALL: [Probe; 3] = [
+        Probe::EcsListClusters,
+        Probe::SsmGetParametersByPath,
+        Probe::SecretsListSecrets,
+    ];
+
+    /// The probe standing in for a read check's service, if there is one.
+    fn for_action(action: &str) -> Option<Probe> {
+        match action.split_once(':')?.0 {
+            "ecs" => Some(Probe::EcsListClusters),
+            "ssm" => Some(Probe::SsmGetParametersByPath),
+            "secretsmanager" => Some(Probe::SecretsListSecrets),
+            _ => None,
+        }
+    }
+
+    fn action(self) -> &'static str {
+        match self {
+            Probe::EcsListClusters => "ecs:ListClusters",
+            Probe::SsmGetParametersByPath => "ssm:GetParametersByPath",
+            Probe::SecretsListSecrets => "secretsmanager:ListSecrets",
+        }
+    }
+}
+
+/// What the permission check needs from AWS. The methods return `Send`
+/// futures so `check_permissions` is `Send` (a Tauri command needs that) for
+/// any implementation; an impl may still write them as `async fn`.
+pub trait PermissionApi: Send + Sync {
+    /// The ARN to simulate for the caller's principal (`iam:GetRole` for a
+    /// role session).
+    fn resolve_principal(
+        &self,
+        principal: PrincipalArn,
+    ) -> impl Future<Output = Result<String, AwsError>> + Send;
+    /// Whether the simulator says `allowed`.
+    fn simulate(
+        &self,
+        request: &SimulationRequest,
+    ) -> impl Future<Output = Result<bool, AwsError>> + Send;
+    fn probe(&self, probe: Probe) -> impl Future<Output = Result<(), AwsError>> + Send;
+}
+
+/// The real thing, from a connection's `SdkConfig`.
+pub struct SdkPermissionApi {
+    iam: aws_sdk_iam::Client,
+    ecs: aws_sdk_ecs::Client,
+    ssm: aws_sdk_ssm::Client,
+    secrets: aws_sdk_secretsmanager::Client,
+}
+
+impl SdkPermissionApi {
+    pub fn new(cfg: &aws_config::SdkConfig) -> Self {
+        // IAM throttles SimulatePrincipalPolicy hard: a full check (about a
+        // hundred simulations) failed a third of its rows with "Rate
+        // exceeded" under standard retries (verified live). Adaptive retry
+        // backs off client-side once throttled, with room to retry.
+        //
+        // The connection's 30 s operation limit counts the retries' backoff
+        // too, which would cut those ten attempts to about six; the check
+        // gets its own, longer limit, and the UI says it can take a while.
+        let iam = aws_sdk_iam::config::Builder::from(cfg)
+            .retry_config(aws_config::retry::RetryConfig::adaptive().with_max_attempts(10))
+            .timeout_config(iam_check_timeouts())
+            .build();
+        SdkPermissionApi {
+            iam: aws_sdk_iam::Client::from_conf(iam),
+            ecs: aws_sdk_ecs::Client::new(cfg),
+            ssm: aws_sdk_ssm::Client::new(cfg),
+            secrets: aws_sdk_secretsmanager::Client::new(cfg),
+        }
+    }
+}
+
+/// The whole of one simulation, retries and backoff included. Ten adaptive
+/// attempts with backoff capped at 20 s fit in two minutes.
+pub const IAM_CHECK_OPERATION_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(120);
+
+fn iam_check_timeouts() -> aws_config::timeout::TimeoutConfig {
+    aws_config::timeout::TimeoutConfig::builder()
+        .operation_timeout(IAM_CHECK_OPERATION_TIMEOUT)
+        .operation_attempt_timeout(super::connection::ATTEMPT_TIMEOUT)
+        .build()
+}
+
+impl PermissionApi for SdkPermissionApi {
+    async fn resolve_principal(&self, principal: PrincipalArn) -> Result<String, AwsError> {
+        identity::resolve_principal(&self.iam, principal).await
+    }
+
+    async fn simulate(&self, request: &SimulationRequest) -> Result<bool, AwsError> {
+        use aws_sdk_iam::types::{ContextEntry as SdkEntry, ContextKeyTypeEnum};
+        const ACTION: &str = "iam:SimulatePrincipalPolicy";
+        let entries = request.context.iter().map(|e| {
+            SdkEntry::builder()
+                .context_key_name(&e.key)
+                .set_context_key_values(Some(e.values.clone()))
+                .context_key_type(if e.is_list() {
+                    ContextKeyTypeEnum::StringList
+                } else {
+                    ContextKeyTypeEnum::String
+                })
+                .build()
+        });
+        let out = self
+            .iam
+            .simulate_principal_policy()
+            .policy_source_arn(&request.principal)
+            .action_names(&request.action)
+            .resource_arns(&request.resource)
+            .set_context_entries(Some(entries.collect()))
+            .send()
+            .await
+            .map_err(|e| classify_sdk_error(ACTION, &e))?;
+        let decision = out
+            .evaluation_results()
+            .first()
+            .map(|r| r.eval_decision().as_str())
+            .ok_or_else(|| AwsError::Other {
+                message: format!("{ACTION} returned no result for {}", request.action),
+            })?;
+        Ok(decision == "allowed")
+    }
+
+    async fn probe(&self, probe: Probe) -> Result<(), AwsError> {
+        let action = probe.action();
+        let classify = |e: &(dyn std::error::Error + 'static)| classify_sdk_error(action, e);
+        match probe {
+            Probe::EcsListClusters => self
+                .ecs
+                .list_clusters()
+                .max_results(1)
+                .send()
+                .await
+                .map(drop)
+                .map_err(|e| classify(&e)),
+            Probe::SsmGetParametersByPath => self
+                .ssm
+                .get_parameters_by_path()
+                .path("/triple-c/environments")
+                .max_results(1)
+                .send()
+                .await
+                .map(drop)
+                .map_err(|e| classify(&e)),
+            Probe::SecretsListSecrets => self
+                .secrets
+                .list_secrets()
+                .max_results(1)
+                .send()
+                .await
+                .map(drop)
+                .map_err(|e| classify(&e)),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum Verdict {
+    Allowed,
+    Denied,
+    Unverified,
+}
+
+/// One row per action. An action checked against several resources (or
+/// with several contexts) is `Denied` if any of them is, else `Unverified`
+/// if any is, else `Allowed`.
+#[derive(Debug, Clone, Serialize)]
+pub struct ActionResult {
+    pub action: String,
+    pub verdict: Verdict,
+    /// Set when the row is `Unverified` because a call failed (throttling,
+    /// network, ...): the error, as `AwsError` displays it. Such a row
+    /// blocks its tier's claim; an `Unverified` row without a note (a write
+    /// in probe mode, an unprobed read) does not.
+    pub note: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct TierResult {
+    pub tier: Tier,
+    pub results: Vec<ActionResult>,
+}
+
+#[derive(Debug, Clone, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum Method {
+    Simulated,
+    /// Simulation wasn't possible; `reason` says why.
+    Probed {
+        reason: String,
+    },
+}
+
+#[derive(Debug, Clone, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum Summary {
+    EnvironmentAdmin,
+    WorkspaceUser,
+    Insufficient,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct PermissionReport {
+    pub identity: CallerIdentity,
+    pub region: String,
+    pub method: Method,
+    pub summary: Summary,
+    /// `[WorkspaceUser, EnvironmentAdmin]`.
+    pub tiers: Vec<TierResult>,
+}
+
+const TIERS: [Tier; 2] = [Tier::WorkspaceUser, Tier::EnvironmentAdmin];
+
+/// One check's result, before checks are folded into per-action rows.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum Outcome {
+    Allowed,
+    Denied,
+    /// Not checkable by design (a write in probe mode, an unprobed read).
+    Unverified,
+    /// The call failed for a reason that says nothing about the permission.
+    Failed(String),
+}
+
+/// The worst of `outcomes`: Denied, then Failed (as `Unverified` with the
+/// first failure as its note), then Unverified, then Allowed.
+fn aggregate(outcomes: &[Outcome]) -> (Verdict, Option<String>) {
+    if outcomes.contains(&Outcome::Denied) {
+        return (Verdict::Denied, None);
+    }
+    if let Some(note) = outcomes.iter().find_map(|o| match o {
+        Outcome::Failed(m) => Some(m.clone()),
+        _ => None,
+    }) {
+        return (Verdict::Unverified, Some(note));
+    }
+    if outcomes.contains(&Outcome::Unverified) {
+        return (Verdict::Unverified, None);
+    }
+    (Verdict::Allowed, None)
+}
+
+/// Folds per-check outcomes (in `checks(tier)` order) into one row per
+/// action, in first-appearance order.
+fn tier_result(tier: Tier, outcomes: Vec<Outcome>) -> TierResult {
+    let mut rows: Vec<(&'static str, Vec<Outcome>)> = Vec::new();
+    for (check, outcome) in checks(tier).iter().zip(outcomes) {
+        match rows.iter_mut().find(|(a, _)| *a == check.action) {
+            Some((_, os)) => os.push(outcome),
+            None => rows.push((check.action, vec![outcome])),
+        }
+    }
+    TierResult {
+        tier,
+        results: rows
+            .into_iter()
+            .map(|(action, os)| {
+                let (verdict, note) = aggregate(&os);
+                ActionResult {
+                    action: action.to_string(),
+                    verdict,
+                    note,
+                }
+            })
+            .collect(),
+    }
+}
+
+/// A tier is claimed when none of its rows is `Denied` or failed (has a
+/// note). Design-level `Unverified` rows don't block. A probed run never
+/// claims the admin tier (R15): it is nearly all writes, which probes can't
+/// see, so "nothing denied" would mean nothing.
+fn summary(tiers: &[TierResult], probed: bool) -> Summary {
+    let clear = |t: Tier| {
+        tiers.iter().filter(|r| r.tier == t).all(|r| {
+            r.results
+                .iter()
+                .all(|a| a.verdict != Verdict::Denied && a.note.is_none())
+        })
+    };
+    if !clear(Tier::WorkspaceUser) {
+        Summary::Insufficient
+    } else if !probed && clear(Tier::EnvironmentAdmin) {
+        Summary::EnvironmentAdmin
+    } else {
+        Summary::WorkspaceUser
+    }
+}
+
+/// Errors that mean the credentials themselves don't work: the UI acts on
+/// these (sign in, re-enter keys) rather than showing a report.
+fn is_credential_error(e: &AwsError) -> bool {
+    matches!(
+        e,
+        AwsError::SsoExpired { .. }
+            | AwsError::InvalidCredentials { .. }
+            | AwsError::ProfileNotFound { .. }
+            | AwsError::KeysMissing
+    )
+}
+
+/// Which tiers the caller's credentials can act as, in `region`.
+///
+/// Simulates every check of both tiers against the caller's principal. It
+/// falls back to probes when the principal can't be simulated (root,
+/// federated user), resolving it is denied (`iam:GetRole`), or the first
+/// simulation is denied. In probe mode a read check whose service has a
+/// probe takes that probe's result; the check behind the fallback (the
+/// caller's own `iam:GetRole` / `iam:SimulatePrincipalPolicy`) is `Denied`;
+/// every other check is `Unverified`.
+///
+/// A credential error (SSO expired, invalid or missing credentials) from
+/// any call is returned as `Err`, as is any other failure resolving the
+/// principal. Other failures of individual checks (throttling, network)
+/// make that row `Unverified` with a note, which blocks its tier's claim.
+/// See [`summary`] for the claim rules.
+pub async fn check_permissions<A: PermissionApi>(
+    api: &A,
+    identity: &CallerIdentity,
+    region: &str,
+) -> Result<PermissionReport, AwsError> {
+    let (method, outcomes) = match simulate_all(api, identity, region).await? {
+        Simulation::Done(outcomes) => (Method::Simulated, outcomes),
+        Simulation::Fallback { reason, denied } => (
+            Method::Probed { reason },
+            probe_all(api, denied.as_deref()).await?,
+        ),
+    };
+    let failed: Vec<&str> = outcomes
+        .iter()
+        .flatten()
+        .filter_map(|o| match o {
+            Outcome::Failed(m) => Some(m.as_str()),
+            _ => None,
+        })
+        .collect();
+    if let Some(first) = failed.first() {
+        let total: usize = outcomes.iter().map(Vec::len).sum();
+        log::warn!(
+            "AWS permission check: {} of {total} checks could not be evaluated (first: {first})",
+            failed.len()
+        );
+    }
+    let probed = matches!(method, Method::Probed { .. });
+    let tiers: Vec<TierResult> = TIERS
+        .into_iter()
+        .zip(outcomes)
+        .map(|(tier, os)| tier_result(tier, os))
+        .collect();
+    Ok(PermissionReport {
+        identity: identity.clone(),
+        region: region.to_string(),
+        method,
+        summary: summary(&tiers, probed),
+        tiers,
+    })
+}
+
+enum Simulation {
+    Done([Vec<Outcome>; 2]),
+    /// Simulation isn't possible. `denied` is the action whose denial
+    /// caused it, if one did.
+    Fallback {
+        reason: String,
+        denied: Option<String>,
+    },
+}
+
+impl Simulation {
+    fn fallback(e: AwsError) -> Self {
+        let denied = match &e {
+            AwsError::AccessDenied { action, .. } => Some(action.clone()),
+            _ => None,
+        };
+        Simulation::Fallback {
+            reason: e.to_string(),
+            denied,
+        }
+    }
+}
+
+fn simulated_outcome(r: Result<bool, AwsError>) -> Result<Outcome, AwsError> {
+    match r {
+        Ok(true) => Ok(Outcome::Allowed),
+        Ok(false) => Ok(Outcome::Denied),
+        Err(e) if is_credential_error(&e) => Err(e),
+        Err(e) => Ok(Outcome::Failed(e.to_string())),
+    }
+}
+
+/// Per-tier outcomes by simulation, or why simulation isn't possible.
+async fn simulate_all<A: PermissionApi>(
+    api: &A,
+    identity: &CallerIdentity,
+    region: &str,
+) -> Result<Simulation, AwsError> {
+    let principal = match principal_for_simulation(&identity.arn) {
+        Ok(p) => p,
+        Err(e) => return Ok(Simulation::fallback(e)),
+    };
+    let principal = match api.resolve_principal(principal).await {
+        Ok(p) => p,
+        Err(e @ AwsError::AccessDenied { .. }) => return Ok(Simulation::fallback(e)),
+        Err(e) => return Err(e),
+    };
+    let p = Placeholders {
+        region,
+        account: &identity.account,
+        principal: &principal,
+    };
+    let mut requests = TIERS
+        .into_iter()
+        .flat_map(|t| checks(t).iter())
+        .map(|c| simulation_request(c, &p, &identity.user_id))
+        .collect::<Vec<_>>()
+        .into_iter();
+    let Some(first) = requests.next() else {
+        return Ok(Simulation::Done([Vec::new(), Vec::new()]));
+    };
+    // The first simulation alone: if the caller may not simulate at all,
+    // that's the moment to fall back, before spending the rest.
+    let first = match api.simulate(&first).await {
+        Err(e @ AwsError::AccessDenied { .. }) => return Ok(Simulation::fallback(e)),
+        r => simulated_outcome(r)?,
+    };
+    // Owned requests: a closure over borrowed ones makes the future's
+    // `Send` unprovable (rustc's higher-ranked closure limitation).
+    let rest: Vec<Outcome> = stream::iter(requests)
+        .map(|r| async move { simulated_outcome(api.simulate(&r).await) })
+        .buffered(CONCURRENCY)
+        .try_collect()
+        .await?;
+    let mut all = std::iter::once(first).chain(rest);
+    Ok(Simulation::Done(
+        TIERS.map(|t| all.by_ref().take(checks(t).len()).collect()),
+    ))
+}
+
+/// Per-tier outcomes from the three probes. `denied` is the action whose
+/// denial forced probing; the caller's own-principal checks of it are
+/// `Denied`.
+async fn probe_all<A: PermissionApi>(
+    api: &A,
+    denied: Option<&str>,
+) -> Result<[Vec<Outcome>; 2], AwsError> {
+    let results =
+        futures_util::future::join_all(Probe::ALL.map(|p| async move { (p, api.probe(p).await) }))
+            .await;
+    if let Some((_, Err(e))) = results
+        .iter()
+        .find(|(_, r)| matches!(r, Err(e) if is_credential_error(e)))
+    {
+        return Err(e.clone());
+    }
+    let probe_outcome = |probe: Probe| match results.iter().find(|(p, _)| *p == probe) {
+        Some((_, Ok(()))) => Outcome::Allowed,
+        Some((_, Err(AwsError::AccessDenied { .. }))) => Outcome::Denied,
+        Some((_, Err(e))) => Outcome::Failed(e.to_string()),
+        None => Outcome::Unverified,
+    };
+    Ok(TIERS.map(|t| {
+        checks(t)
+            .iter()
+            .map(|c| {
+                if denied == Some(c.action) && c.resource == "{principal}" {
+                    return Outcome::Denied;
+                }
+                match Probe::for_action(c.action) {
+                    Some(probe) if !c.write => probe_outcome(probe),
+                    _ => Outcome::Unverified,
+                }
+            })
+            .collect()
+    }))
+}
+
+#[cfg(test)]
+mod tests;

app/src-tauri/src/aws/permissions/tests.rs

@@ -0,0 +1,640 @@
+use std::collections::HashSet;
+use std::sync::Mutex;
+
+use super::*;
+use crate::aws::policies::{checks, Check, ContextValue, Placeholders, Tier};
+
+const USER_ID: &str = "AROAEXAMPLEID:alice@example.com";
+const ROLE_ARN: &str =
+    "arn:aws:iam::111122223333:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_Ws_abc";
+
+fn identity() -> CallerIdentity {
+    CallerIdentity {
+        account: "111122223333".into(),
+        arn: "arn:aws:sts::111122223333:assumed-role/AWSReservedSSO_Ws_abc/alice@example.com"
+            .into(),
+        user_id: USER_ID.into(),
+    }
+}
+
+const ALL_PROBES: [Probe; 3] = [
+    Probe::EcsListClusters,
+    Probe::SsmGetParametersByPath,
+    Probe::SecretsListSecrets,
+];
+
+/// A simulation call as the fake saw it.
+#[derive(Debug, Clone)]
+struct Simulated {
+    principal: String,
+    action: String,
+    resource: String,
+    context: Vec<ContextEntry>,
+}
+
+struct FakeApi {
+    allow: HashSet<&'static str>,
+    simulate_denied: bool,
+    get_role_denied: bool,
+    /// Returned by `resolve_principal` (after `get_role_denied`).
+    resolve_error: Option<AwsError>,
+    /// Returned by `simulate` for the named action.
+    simulate_errors: Vec<(&'static str, AwsError)>,
+    probes_ok: HashSet<Probe>,
+    /// Returned by every probe not in `probes_ok` (default: AccessDenied).
+    probe_error: Option<AwsError>,
+    simulated: Mutex<Vec<Simulated>>,
+    probed: Mutex<Vec<Probe>>,
+}
+
+impl FakeApi {
+    fn allowing(tiers: &[Tier]) -> Self {
+        let allow = tiers
+            .iter()
+            .flat_map(|t| checks(*t).iter().map(|c| c.action))
+            .collect();
+        FakeApi {
+            allow,
+            simulate_denied: false,
+            get_role_denied: false,
+            resolve_error: None,
+            simulate_errors: Vec::new(),
+            probes_ok: ALL_PROBES.into_iter().collect(),
+            probe_error: None,
+            simulated: Mutex::new(Vec::new()),
+            probed: Mutex::new(Vec::new()),
+        }
+    }
+
+    fn simulated(&self) -> Vec<Simulated> {
+        self.simulated.lock().unwrap().clone()
+    }
+}
+
+impl PermissionApi for FakeApi {
+    async fn resolve_principal(&self, principal: PrincipalArn) -> Result<String, AwsError> {
+        if self.get_role_denied {
+            return Err(AwsError::AccessDenied {
+                action: "iam:GetRole".into(),
+                message: "not authorized to perform: iam:GetRole".into(),
+            });
+        }
+        if let Some(e) = &self.resolve_error {
+            return Err(e.clone());
+        }
+        Ok(match principal {
+            PrincipalArn::Exact(arn) => arn,
+            PrincipalArn::AssumedRole { .. } => ROLE_ARN.into(),
+        })
+    }
+
+    async fn simulate(&self, request: &SimulationRequest) -> Result<bool, AwsError> {
+        self.simulated.lock().unwrap().push(Simulated {
+            principal: request.principal.clone(),
+            action: request.action.clone(),
+            resource: request.resource.clone(),
+            context: request.context.clone(),
+        });
+        if self.simulate_denied {
+            return Err(AwsError::AccessDenied {
+                action: "iam:SimulatePrincipalPolicy".into(),
+                message: "not authorized to perform: iam:SimulatePrincipalPolicy".into(),
+            });
+        }
+        if let Some((_, e)) = self
+            .simulate_errors
+            .iter()
+            .find(|(a, _)| *a == request.action)
+        {
+            return Err(e.clone());
+        }
+        Ok(self.allow.contains(request.action.as_str()))
+    }
+
+    async fn probe(&self, probe: Probe) -> Result<(), AwsError> {
+        self.probed.lock().unwrap().push(probe);
+        if self.probes_ok.contains(&probe) {
+            Ok(())
+        } else if let Some(e) = &self.probe_error {
+            Err(e.clone())
+        } else {
+            Err(AwsError::AccessDenied {
+                action: format!("{probe:?}"),
+                message: "denied".into(),
+            })
+        }
+    }
+}
+
+fn try_run(api: &FakeApi, id: &CallerIdentity) -> Result<PermissionReport, AwsError> {
+    tokio::runtime::Builder::new_current_thread()
+        .build()
+        .unwrap()
+        .block_on(check_permissions(api, id, "eu-west-1"))
+}
+
+fn run(api: &FakeApi) -> PermissionReport {
+    try_run(api, &identity()).unwrap()
+}
+
+fn row<'a>(report: &'a PermissionReport, t: Tier, action: &str) -> &'a ActionResult {
+    tier(report, t)
+        .results
+        .iter()
+        .find(|r| r.action == action)
+        .unwrap_or_else(|| panic!("{action} not in {t:?}"))
+}
+
+fn throttled() -> AwsError {
+    AwsError::Other {
+        message: "Rate exceeded (Throttling)".into(),
+    }
+}
+
+fn tier(report: &PermissionReport, t: Tier) -> &TierResult {
+    report.tiers.iter().find(|r| r.tier == t).unwrap()
+}
+
+fn verdict(report: &PermissionReport, t: Tier, action: &str) -> Verdict {
+    tier(report, t)
+        .results
+        .iter()
+        .find(|r| r.action == action)
+        .unwrap_or_else(|| panic!("{action} not in {t:?}"))
+        .verdict
+        .clone()
+}
+
+#[test]
+fn a_full_workspace_policy_reports_workspace_user() {
+    let api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    let report = run(&api);
+    assert_eq!(report.method, Method::Simulated);
+    assert_eq!(report.summary, Summary::WorkspaceUser);
+    assert_eq!(report.region, "eu-west-1");
+    assert_eq!(report.identity, identity());
+    let tiers: Vec<Tier> = report.tiers.iter().map(|t| t.tier).collect();
+    assert_eq!(tiers, [Tier::WorkspaceUser, Tier::EnvironmentAdmin]);
+    assert!(tier(&report, Tier::WorkspaceUser)
+        .results
+        .iter()
+        .all(|r| r.verdict == Verdict::Allowed));
+    // Every check was simulated against the resolved role, not the session.
+    let sims = api.simulated();
+    let total = checks(Tier::WorkspaceUser).len() + checks(Tier::EnvironmentAdmin).len();
+    assert_eq!(sims.len(), total);
+    assert!(sims.iter().all(|s| s.principal == ROLE_ARN));
+}
+
+#[test]
+fn admin_and_workspace_policies_report_environment_admin() {
+    let api = FakeApi::allowing(&[Tier::WorkspaceUser, Tier::EnvironmentAdmin]);
+    let report = run(&api);
+    assert_eq!(report.method, Method::Simulated);
+    assert_eq!(report.summary, Summary::EnvironmentAdmin);
+}
+
+#[test]
+fn a_missing_action_reports_insufficient_and_names_it() {
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser, Tier::EnvironmentAdmin]);
+    api.allow.remove("iam:PassRole");
+    let report = run(&api);
+    assert_eq!(report.summary, Summary::Insufficient);
+    assert_eq!(
+        verdict(&report, Tier::WorkspaceUser, "iam:PassRole"),
+        Verdict::Denied
+    );
+    assert_eq!(
+        verdict(&report, Tier::WorkspaceUser, "ecs:RunTask"),
+        Verdict::Allowed
+    );
+}
+
+#[test]
+fn an_admin_gap_still_reports_workspace_user() {
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser, Tier::EnvironmentAdmin]);
+    api.allow.remove("ec2:CreateVpc");
+    let report = run(&api);
+    assert_eq!(report.summary, Summary::WorkspaceUser);
+    assert_eq!(
+        verdict(&report, Tier::EnvironmentAdmin, "ec2:CreateVpc"),
+        Verdict::Denied
+    );
+}
+
+/// An action checked against several resources is one row; any denial wins.
+#[test]
+fn an_action_checked_twice_is_one_row_and_denied_if_either_is() {
+    let api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    let report = run(&api);
+    let rows = tier(&report, Tier::WorkspaceUser)
+        .results
+        .iter()
+        .filter(|r| r.action == "ssm:StartSession")
+        .count();
+    assert_eq!(rows, 1);
+    let failed = || Outcome::Failed("Throttling".into());
+    assert_eq!(
+        aggregate(&[Outcome::Allowed, Outcome::Denied, failed()]),
+        (Verdict::Denied, None)
+    );
+    assert_eq!(
+        aggregate(&[Outcome::Allowed, Outcome::Unverified, failed()]),
+        (Verdict::Unverified, Some("Throttling".into()))
+    );
+    assert_eq!(
+        aggregate(&[Outcome::Allowed, Outcome::Unverified]),
+        (Verdict::Unverified, None)
+    );
+    assert_eq!(aggregate(&[Outcome::Allowed]), (Verdict::Allowed, None));
+}
+
+fn context_value<'a>(s: &'a Simulated, key: &str) -> Option<&'a ContextEntry> {
+    s.context.iter().find(|e| e.key == key)
+}
+
+#[test]
+fn owner_context_is_sent_with_owner_scoped_checks() {
+    let api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    run(&api);
+    let sims = api.simulated();
+    let run_task = sims.iter().find(|s| s.action == "ecs:RunTask").unwrap();
+    let owner = context_value(run_task, "aws:RequestTag/triple-c:owner").unwrap();
+    assert_eq!(owner.values, [USER_ID]);
+    // Literals are rendered like resources.
+    let cluster = context_value(run_task, "ecs:cluster").unwrap();
+    assert_eq!(
+        cluster.values,
+        ["arn:aws:ecs:eu-west-1:111122223333:cluster/triple-c-probe"]
+    );
+    assert_eq!(
+        run_task.resource,
+        "arn:aws:ecs:eu-west-1:111122223333:task-definition/triple-c-probe:1"
+    );
+    // aws:userid on every simulation.
+    for s in &sims {
+        let userid = context_value(s, "aws:userid")
+            .unwrap_or_else(|| panic!("{} has no aws:userid", s.action));
+        assert_eq!(userid.values, [USER_ID], "{}", s.action);
+    }
+}
+
+#[test]
+fn the_principal_placeholder_is_the_resolved_role() {
+    let api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    run(&api);
+    let sims = api.simulated();
+    let get_role = sims
+        .iter()
+        .find(|s| s.action == "iam:GetRole" && s.resource == ROLE_ARN)
+        .expect("iam:GetRole on the caller's own role");
+    // The policies name a user's own ARN by `${aws:username}`.
+    assert_eq!(
+        context_value(get_role, "aws:username").unwrap().values,
+        [ROLE_ARN.rsplit('/').next().unwrap()]
+    );
+}
+
+#[test]
+fn a_repeated_context_key_is_one_string_list_entry() {
+    static CTX: &[(&str, ContextValue)] = &[
+        ("aws:TagKeys", ContextValue::Literal("triple-c:owner")),
+        (
+            "ecs:cluster",
+            ContextValue::Literal("arn:{region}:{account}"),
+        ),
+        ("aws:TagKeys", ContextValue::Literal("triple-c:component")),
+        ("aws:TagKeys", ContextValue::OwnerId),
+    ];
+    let check = Check {
+        action: "ecs:TagResource",
+        resource: "arn:aws:ecs:{region}:{account}:task/x",
+        context: CTX,
+        write: true,
+    };
+    let p = Placeholders {
+        region: "eu-west-1",
+        account: "111122223333",
+        principal: ROLE_ARN,
+    };
+    let req = simulation_request(&check, &p, USER_ID);
+    assert_eq!(req.principal, ROLE_ARN);
+    assert_eq!(req.action, "ecs:TagResource");
+    assert_eq!(req.resource, "arn:aws:ecs:eu-west-1:111122223333:task/x");
+    assert_eq!(
+        req.context,
+        [
+            ContextEntry {
+                key: "aws:TagKeys".into(),
+                values: vec![
+                    "triple-c:owner".into(),
+                    "triple-c:component".into(),
+                    USER_ID.into()
+                ],
+            },
+            ContextEntry {
+                key: "ecs:cluster".into(),
+                values: vec!["arn:eu-west-1:111122223333".into()],
+            },
+            ContextEntry {
+                key: "aws:userid".into(),
+                values: vec![USER_ID.into()],
+            },
+        ]
+    );
+    assert!(req.context[0].is_list());
+    assert!(!req.context[1].is_list());
+}
+
+#[test]
+fn a_check_naming_aws_userid_itself_is_not_sent_it_twice() {
+    static CTX: &[(&str, ContextValue)] = &[("aws:userid", ContextValue::OwnerId)];
+    let check = Check {
+        action: "sts:GetCallerIdentity",
+        resource: "*",
+        context: CTX,
+        write: false,
+    };
+    let p = Placeholders {
+        region: "r",
+        account: "a",
+        principal: "p",
+    };
+    let req = simulation_request(&check, &p, USER_ID);
+    assert_eq!(
+        req.context,
+        [ContextEntry {
+            key: "aws:userid".into(),
+            values: vec![USER_ID.into()],
+        }]
+    );
+}
+
+#[test]
+fn a_denied_simulation_falls_back_to_probes_and_marks_writes_unverified() {
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser, Tier::EnvironmentAdmin]);
+    api.simulate_denied = true;
+    let report = run(&api);
+    match &report.method {
+        Method::Probed { reason } => {
+            assert!(reason.contains("iam:SimulatePrincipalPolicy"), "{reason}")
+        }
+        m => panic!("expected Probed, got {m:?}"),
+    }
+    // Only the first simulation was tried.
+    assert_eq!(api.simulated().len(), 1);
+    let mut probed = api.probed.lock().unwrap().clone();
+    probed.sort_by_key(|p| format!("{p:?}"));
+    let mut all = ALL_PROBES.to_vec();
+    all.sort_by_key(|p| format!("{p:?}"));
+    assert_eq!(probed, all);
+
+    let ws = Tier::WorkspaceUser;
+    assert_eq!(verdict(&report, ws, "ecs:RunTask"), Verdict::Unverified);
+    assert_eq!(verdict(&report, ws, "iam:PassRole"), Verdict::Unverified);
+    // Reads with a probe get its result.
+    assert_eq!(verdict(&report, ws, "ecs:ListClusters"), Verdict::Allowed);
+    assert_eq!(
+        verdict(&report, ws, "ecs:DescribeClusters"),
+        Verdict::Allowed
+    );
+    assert_eq!(
+        verdict(&report, ws, "ssm:GetParametersByPath"),
+        Verdict::Allowed
+    );
+    assert_eq!(
+        verdict(&report, ws, "secretsmanager:ListSecrets"),
+        Verdict::Allowed
+    );
+    // Reads with no probe are unverified.
+    assert_eq!(
+        verdict(&report, ws, "logs:FilterLogEvents"),
+        Verdict::Unverified
+    );
+    assert_eq!(verdict(&report, ws, "iam:GetRole"), Verdict::Unverified);
+    assert_eq!(
+        verdict(&report, ws, "sts:GetCallerIdentity"),
+        Verdict::Unverified
+    );
+    // The fallback itself is evidence: the caller may not simulate itself,
+    // which both tiers need.
+    for t in [ws, Tier::EnvironmentAdmin] {
+        assert_eq!(
+            verdict(&report, t, "iam:SimulatePrincipalPolicy"),
+            Verdict::Denied
+        );
+    }
+    assert_eq!(report.summary, Summary::Insufficient);
+}
+
+#[test]
+fn a_denied_get_role_falls_back_to_probes() {
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    api.get_role_denied = true;
+    let report = run(&api);
+    match &report.method {
+        Method::Probed { reason } => assert!(reason.contains("iam:GetRole"), "{reason}"),
+        m => panic!("expected Probed, got {m:?}"),
+    }
+    assert!(api.simulated().is_empty());
+    assert_eq!(api.probed.lock().unwrap().len(), ALL_PROBES.len());
+    // Denied on the caller's own role: direct evidence.
+    assert_eq!(
+        verdict(&report, Tier::WorkspaceUser, "iam:GetRole"),
+        Verdict::Denied
+    );
+    assert_eq!(report.summary, Summary::Insufficient);
+}
+
+#[test]
+fn an_unsimulatable_principal_falls_back_to_probes() {
+    let api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    let mut id = identity();
+    id.arn = "arn:aws:iam::111122223333:root".into();
+    let report = try_run(&api, &id).unwrap();
+    match &report.method {
+        Method::Probed { reason } => assert!(reason.contains("simulation"), "{reason}"),
+        m => panic!("expected Probed, got {m:?}"),
+    }
+    assert!(api.simulated().is_empty());
+}
+
+/// R15: the admin tier is nearly all writes, so a probed run can't vouch
+/// for it — every probe passing still caps at WorkspaceUser.
+#[test]
+fn a_probed_run_never_claims_environment_admin() {
+    let api = FakeApi::allowing(&[Tier::WorkspaceUser, Tier::EnvironmentAdmin]);
+    let mut id = identity();
+    id.arn = "arn:aws:iam::111122223333:root".into();
+    let report = try_run(&api, &id).unwrap();
+    assert!(matches!(report.method, Method::Probed { .. }));
+    assert!(tier(&report, Tier::EnvironmentAdmin)
+        .results
+        .iter()
+        .all(|r| r.verdict != Verdict::Denied));
+    assert_eq!(report.summary, Summary::WorkspaceUser);
+}
+
+#[test]
+fn throttled_simulations_block_the_tier_and_carry_notes() {
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser, Tier::EnvironmentAdmin]);
+    api.simulate_errors = vec![("ec2:CreateVpc", throttled())];
+    let report = run(&api);
+    assert_eq!(report.method, Method::Simulated);
+    let r = row(&report, Tier::EnvironmentAdmin, "ec2:CreateVpc");
+    assert_eq!(r.verdict, Verdict::Unverified);
+    assert!(r.note.as_deref().unwrap().contains("Throttling"), "{r:?}");
+    // Allowed rows carry no note.
+    assert_eq!(row(&report, Tier::WorkspaceUser, "ecs:RunTask").note, None);
+    assert_eq!(report.summary, Summary::WorkspaceUser);
+
+    // In the workspace tier, it blocks everything.
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser, Tier::EnvironmentAdmin]);
+    api.simulate_errors = vec![("ecs:RunTask", throttled())];
+    let report = run(&api);
+    assert_eq!(report.summary, Summary::Insufficient);
+    assert!(row(&report, Tier::WorkspaceUser, "ecs:RunTask")
+        .note
+        .is_some());
+}
+
+#[test]
+fn a_throttled_first_simulation_is_a_note_not_a_fallback() {
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser, Tier::EnvironmentAdmin]);
+    let first = checks(Tier::WorkspaceUser)[0].action;
+    api.simulate_errors = vec![(first, throttled())];
+    let report = run(&api);
+    assert_eq!(report.method, Method::Simulated);
+    assert!(row(&report, Tier::WorkspaceUser, first).note.is_some());
+    assert_eq!(report.summary, Summary::Insufficient);
+}
+
+#[test]
+fn an_expired_sso_session_mid_check_is_an_error() {
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser, Tier::EnvironmentAdmin]);
+    let sso = AwsError::SsoExpired {
+        profile: "dev".into(),
+    };
+    api.simulate_errors = vec![("logs:FilterLogEvents", sso.clone())];
+    assert_eq!(try_run(&api, &identity()).unwrap_err(), sso);
+}
+
+#[test]
+fn credential_errors_anywhere_are_errors() {
+    let bad = AwsError::InvalidCredentials {
+        message: "ExpiredToken".into(),
+    };
+    // From resolving the principal.
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    api.resolve_error = Some(bad.clone());
+    assert_eq!(try_run(&api, &identity()).unwrap_err(), bad);
+    // From the first simulation.
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    api.simulate_errors = vec![(checks(Tier::WorkspaceUser)[0].action, bad.clone())];
+    assert_eq!(try_run(&api, &identity()).unwrap_err(), bad);
+    // From a probe.
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    api.get_role_denied = true;
+    api.probes_ok.remove(&Probe::SecretsListSecrets);
+    api.probe_error = Some(AwsError::KeysMissing);
+    assert_eq!(
+        try_run(&api, &identity()).unwrap_err(),
+        AwsError::KeysMissing
+    );
+}
+
+#[test]
+fn a_transport_error_resolving_the_principal_is_an_error() {
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    let net = AwsError::Other {
+        message: "dispatch failure: connection refused".into(),
+    };
+    api.resolve_error = Some(net.clone());
+    assert_eq!(try_run(&api, &identity()).unwrap_err(), net);
+    assert!(api.probed.lock().unwrap().is_empty());
+}
+
+#[test]
+fn a_failed_probe_marks_its_reads_denied() {
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    api.simulate_denied = true;
+    api.probes_ok.remove(&Probe::EcsListClusters);
+    let report = run(&api);
+    let ws = Tier::WorkspaceUser;
+    assert_eq!(verdict(&report, ws, "ecs:ListClusters"), Verdict::Denied);
+    assert_eq!(
+        verdict(&report, ws, "ecs:DescribeClusters"),
+        Verdict::Denied
+    );
+    assert_eq!(
+        verdict(&report, ws, "secretsmanager:ListSecrets"),
+        Verdict::Allowed
+    );
+    assert_eq!(report.summary, Summary::Insufficient);
+}
+
+#[test]
+fn a_probe_failing_for_another_reason_leaves_its_reads_unverified_and_blocks() {
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    let mut id = identity();
+    id.arn = "arn:aws:iam::111122223333:root".into();
+    api.probes_ok.remove(&Probe::EcsListClusters);
+    api.probe_error = Some(AwsError::Other {
+        message: "connection reset".into(),
+    });
+    let report = try_run(&api, &id).unwrap();
+    let r = row(&report, Tier::WorkspaceUser, "ecs:ListClusters");
+    assert_eq!(r.verdict, Verdict::Unverified);
+    assert!(r.note.as_deref().unwrap().contains("connection reset"));
+    // Design-level unverified rows carry no note.
+    assert_eq!(row(&report, Tier::WorkspaceUser, "ecs:RunTask").note, None);
+    assert_eq!(report.summary, Summary::Insufficient);
+}
+
+#[test]
+fn the_report_serializes_for_the_ui() {
+    let mut api = FakeApi::allowing(&[Tier::WorkspaceUser]);
+    api.get_role_denied = true;
+    let v = serde_json::to_value(run(&api)).unwrap();
+    // Probed because iam:GetRole is denied, which the workspace tier needs.
+    assert_eq!(v["summary"], "insufficient");
+    assert!(v["tiers"][0]["results"][0]
+        .as_object()
+        .unwrap()
+        .contains_key("note"));
+    assert_eq!(v["tiers"][0]["tier"], "workspace_user");
+    assert!(v["method"]["probed"]["reason"].is_string(), "{v}");
+    assert!(["allowed", "denied", "unverified"]
+        .contains(&v["tiers"][0]["results"][0]["verdict"].as_str().unwrap()));
+}
+
+/// Tauri commands need a `Send` future.
+#[allow(dead_code)]
+fn check_permissions_is_send() {
+    fn assert_send<T: Send>(_: T) {}
+    fn with<A: PermissionApi>(api: &A, id: &CallerIdentity) {
+        assert_send(check_permissions(api, id, "r"));
+    }
+    let _ = with::<SdkPermissionApi>;
+}
+
+/// D8: CloudFormation left the policies, so nothing probes it either.
+#[test]
+fn no_probe_is_cloudformation() {
+    assert_eq!(Probe::ALL, ALL_PROBES);
+    for p in Probe::ALL {
+        assert!(!p.action().starts_with("cloudformation:"), "{p:?}");
+        assert_eq!(Probe::for_action(p.action()), Some(p));
+    }
+    assert_eq!(Probe::for_action("cloudformation:DescribeStacks"), None);
+}
+
+#[test]
+fn the_iam_check_gets_room_for_its_throttled_retries() {
+    let t = iam_check_timeouts();
+    assert_eq!(t.operation_timeout(), Some(IAM_CHECK_OPERATION_TIMEOUT));
+    assert!(IAM_CHECK_OPERATION_TIMEOUT > crate::aws::connection::OPERATION_TIMEOUT);
+    // Ten adaptive attempts, backoff capped at 20 s, fit inside it.
+    assert!(IAM_CHECK_OPERATION_TIMEOUT >= std::time::Duration::from_secs(9 * 20 / 2 + 20));
+    assert_eq!(t.operation_attempt_timeout(), Some(crate::aws::connection::ATTEMPT_TIMEOUT));
+}

app/src-tauri/src/aws/policy_eval.rs

@@ -0,0 +1,303 @@
+//! The test-only IAM evaluator the policy drift guards use (moved here from
+//! `policies.rs` so the Terraform-module tests can ask it too). It is
+//! deliberately small: the operators the shipped policies use and nothing
+//! else; an unknown operator fails the test rather than being ignored. It is
+//! not IAM -- `live_tests.rs` and the live runs are the proof.
+
+use serde_json::Value;
+
+use super::policies::{render, Check, ContextValue, Placeholders};
+
+pub(crate) const AT: Placeholders = Placeholders {
+    region: "us-west-2",
+    account: "111122223333",
+    principal: "arn:aws:iam::111122223333:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_Dev_0123456789abcdef",
+};
+pub(crate) const ME: &str = "AROAEXAMPLEME:alice@example.com";
+pub(crate) const SOMEONE_ELSE: &str = "AROAEXAMPLEOTHER:bob@example.com";
+
+/// What [`Request::resolve`] turns IAM's `${*}` into: a literal `*` in a
+/// pattern, which [`glob`] matches only against a `*`.
+const LITERAL_STAR: char = '\u{e000}';
+
+/// IAM wildcard match: `*` is any run of characters (including `:` and
+/// `/`), `?` is exactly one; [`LITERAL_STAR`] is a plain `*`.
+pub(crate) fn glob(pattern: &str, text: &str) -> bool {
+    let p: Vec<char> = pattern.chars().collect();
+    let t: Vec<char> = text.chars().collect();
+    let (mut pi, mut ti) = (0, 0);
+    let (mut star, mut mark) = (None, 0);
+    while ti < t.len() {
+        if pi < p.len()
+            && (p[pi] == '?' || p[pi] == t[ti] || (p[pi] == LITERAL_STAR && t[ti] == '*'))
+        {
+            pi += 1;
+            ti += 1;
+        } else if pi < p.len() && p[pi] == '*' {
+            star = Some(pi);
+            mark = ti;
+            pi += 1;
+        } else if let Some(s) = star {
+            pi = s + 1;
+            mark += 1;
+            ti = mark;
+        } else {
+            return false;
+        }
+    }
+    while pi < p.len() && p[pi] == '*' {
+        pi += 1;
+    }
+    pi == p.len()
+}
+
+pub(crate) fn parse(name: &str, json: &str) -> Value {
+    serde_json::from_str(json).unwrap_or_else(|e| panic!("{name} is not JSON: {e}"))
+}
+
+pub(crate) fn statements_of(doc: &Value) -> Vec<Value> {
+    doc["Statement"]
+        .as_array()
+        .expect("policy has no Statement array")
+        .clone()
+}
+
+pub(crate) fn effect(stmt: &Value) -> &str {
+    stmt["Effect"].as_str().unwrap_or("<no Effect>")
+}
+
+/// `Action` / `Resource` / condition values: a string or an array of them.
+pub(crate) fn strings(v: &Value) -> Vec<String> {
+    match v {
+        Value::String(s) => vec![s.clone()],
+        Value::Array(a) => a
+            .iter()
+            .map(|x| x.as_str().expect("expected a string").to_string())
+            .collect(),
+        other => panic!("expected a string or array, got {other}"),
+    }
+}
+
+pub(crate) fn actions(stmt: &Value) -> Vec<String> {
+    strings(&stmt["Action"])
+}
+
+pub(crate) fn resources(stmt: &Value) -> Vec<String> {
+    strings(&stmt["Resource"])
+}
+
+pub(crate) fn sid(stmt: &Value) -> &str {
+    stmt["Sid"].as_str().unwrap_or("<no Sid>")
+}
+
+pub(crate) fn rendered(check: &Check) -> String {
+    render(check.resource, &AT)
+}
+
+/// The request: who calls, and whose the resource / request tag is.
+#[derive(Clone, Copy)]
+pub(crate) struct Request<'a> {
+    pub check: &'a Check,
+    /// `${aws:userid}` of the caller.
+    pub caller: &'a str,
+    /// What `OwnerId` context entries carry.
+    pub owner: &'a str,
+}
+
+impl Request<'_> {
+    pub(crate) fn context_value(&self, key: &str) -> Option<String> {
+        self.context_values(key).into_iter().next()
+    }
+
+    /// All values of a (possibly multi-valued) key.
+    pub(crate) fn context_values(&self, key: &str) -> Vec<String> {
+        self.check
+            .context
+            .iter()
+            .filter(|(k, _)| *k == key)
+            .map(|(_, v)| match v {
+                ContextValue::OwnerId => self.owner.to_string(),
+                ContextValue::Literal(l) => render(l, &AT),
+            })
+            .collect()
+    }
+
+    /// Resolves `${…}` policy variables the way the simulator does: from
+    /// the request context. An unresolvable variable makes the string
+    /// match nothing (`None`).
+    pub(crate) fn resolve(&self, s: &str) -> Option<String> {
+        let mut out = String::new();
+        let mut rest = s;
+        while let Some(start) = rest.find("${") {
+            out.push_str(&rest[..start]);
+            let end = rest[start..].find('}').expect("unterminated ${") + start;
+            let name = &rest[start + 2..end];
+            let value = if name == "*" {
+                Some(LITERAL_STAR.to_string())
+            } else if name == "aws:userid" {
+                Some(self.caller.to_string())
+            } else {
+                self.context_value(name)
+            };
+            out.push_str(&value?);
+            rest = &rest[end + 1..];
+        }
+        out.push_str(rest);
+        Some(out)
+    }
+}
+
+/// Statements that name the action and one of whose resources matches
+/// the rendered resource.
+pub(crate) fn matching<'s>(stmts: &'s [Value], req: &Request) -> Vec<&'s Value> {
+    let resource = rendered(req.check);
+    stmts
+        .iter()
+        .filter(|s| actions(s).iter().any(|a| glob(a, req.check.action)))
+        .filter(|s| {
+            resources(s)
+                .iter()
+                .filter_map(|r| req.resolve(r))
+                .any(|r| glob(&r, &resource))
+        })
+        .collect()
+}
+
+/// A deliberately small IAM condition evaluator: the operators the
+/// shipped policies use, and nothing else (an unknown operator fails the
+/// test rather than being ignored).
+pub(crate) fn conditions_hold(stmt: &Value, req: &Request) -> bool {
+    let Some(cond) = stmt.get("Condition") else {
+        return true;
+    };
+    let cond = cond.as_object().expect("Condition is an object");
+    cond.iter().all(|(op, entries)| {
+        let entries = entries.as_object().expect("condition block is an object");
+        // ForAllValues: every value of the (multi-valued) key matches
+        // one of the policy's values. Vacuously true when the key is
+        // absent, which is why statements pair it with a required key.
+        if let Some(base) = op.strip_prefix("ForAllValues:") {
+            assert_eq!(
+                base,
+                "StringEquals",
+                "{}: unsupported ForAllValues operator",
+                sid(stmt)
+            );
+            return entries.iter().all(|(key, want)| {
+                let allowed: Vec<String> = strings(want)
+                    .iter()
+                    .filter_map(|p| req.resolve(p))
+                    .collect();
+                req.context_values(key).iter().all(|v| allowed.contains(v))
+            });
+        }
+        if op == "Null" {
+            return entries.iter().all(|(key, want)| {
+                let absent = req.context_value(key).is_none();
+                match want.as_str() {
+                    Some("true") => absent,
+                    Some("false") => !absent,
+                    _ => panic!("{}: Null takes \"true\" or \"false\"", sid(stmt)),
+                }
+            });
+        }
+        let (base, if_exists) = match op.strip_suffix("IfExists") {
+            Some(b) => (b, true),
+            None => (op.as_str(), false),
+        };
+        // A negated operator holds when the key is absent, and
+        // otherwise when no value matches.
+        let (matches, negated): (fn(&str, &str) -> bool, bool) = match base {
+            "StringEquals" => (|p, v| p == v, false),
+            "StringLike" | "ArnLike" => (glob, false),
+            "StringNotEquals" => (|p, v| p == v, true),
+            "StringNotLike" => (glob, true),
+            other => panic!("{}: unsupported condition operator {other}", sid(stmt)),
+        };
+        entries
+            .iter()
+            .all(|(key, want)| match req.context_value(key) {
+                None => if_exists || negated,
+                Some(value) => {
+                    let any = strings(want)
+                        .iter()
+                        .filter_map(|p| req.resolve(p))
+                        .any(|p| matches(&p, &value));
+                    any != negated
+                }
+            })
+    })
+}
+
+/// Allowed by some Allow and by no Deny among `stmts`.
+pub(crate) fn evaluate_in(stmts: &[Value], req: Request) -> bool {
+    let applies = |s: &&Value| conditions_hold(s, &req);
+    let allowed = matching(stmts, &req)
+        .into_iter()
+        .filter(|s| effect(s) == "Allow")
+        .any(|s| applies(&s));
+    let denied = matching(stmts, &req)
+        .into_iter()
+        .filter(|s| effect(s) == "Deny")
+        .any(|s| applies(&s));
+    allowed && !denied
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ContextValue::Literal;
+
+    #[test]
+    fn glob_behaves_like_iam_wildcards() {
+        assert!(glob("ecs:Describe*", "ecs:DescribeClusters"));
+        assert!(!glob("ecs:Describe*", "ecs:ListClusters"));
+        assert!(glob(
+            "arn:aws:ecs:*:*:task/triple-c-*/*",
+            "arn:aws:ecs:us-west-2:1:task/triple-c-x/abc"
+        ));
+        assert!(!glob(
+            "arn:aws:ecs:*:*:task/triple-c-*/*",
+            "arn:aws:ecs:us-west-2:1:task/other/abc"
+        ));
+        assert!(glob("a?c", "abc"));
+        assert!(!glob("a?c", "ac"));
+        // `${*}` (resolved to LITERAL_STAR) matches only a real `*`.
+        let literal = format!("arn:aws:ec2:*:*:{LITERAL_STAR}/{LITERAL_STAR}");
+        assert!(glob(&literal, "arn:aws:ec2:us-west-2:1:*/*"));
+        assert!(!glob(&literal, "arn:aws:ec2:us-west-2:1:elastic-ip/eipalloc-1"));
+    }
+
+    #[test]
+    fn for_all_values_is_vacuous_on_an_absent_key() {
+        let stmt: Value = serde_json::json!({
+            "Sid": "T", "Effect": "Allow", "Action": "x:Y", "Resource": "*",
+            "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": ["a", "b"] } }
+        });
+        let check = |context| Check {
+            action: "x:Y",
+            resource: "*",
+            context,
+            write: true,
+        };
+        let holds = |c: &Check| {
+            conditions_hold(
+                &stmt,
+                &Request {
+                    check: c,
+                    caller: ME,
+                    owner: ME,
+                },
+            )
+        };
+        assert!(holds(&check(&[])));
+        assert!(holds(&check(&[
+            ("aws:TagKeys", Literal("a")),
+            ("aws:TagKeys", Literal("b"))
+        ])));
+        assert!(!holds(&check(&[
+            ("aws:TagKeys", Literal("a")),
+            ("aws:TagKeys", Literal("c"))
+        ])));
+    }
+}

app/src-tauri/src/aws/runtime.rs

@@ -0,0 +1,463 @@
+//! What the AWS host asks AWS around a task, besides running it
+//! (`tasks.rs`) and preparing its resources (`workspace.rs`): the
+//! environment's record, whether the caller is onboarded, the agent token of
+//! a running task (P2), waiting for a new access point, and removing a
+//! project's resources.
+//!
+//! Like the other `aws/` modules, the decisions are made by the functions
+//! here over a small trait ([`RuntimeApi`]) so a fake exercises them; the SDK
+//! calls are in [`SdkRuntimeApi`].
+
+use std::future::Future;
+use std::time::Duration;
+
+use aws_config::SdkConfig;
+use aws_sdk_secretsmanager::error::ProvideErrorMetadata;
+
+use super::environments::{knowable, parse_environment_record, EnvironmentInfo, Knowable};
+use super::error::{classify_sdk_error, AwsError};
+use super::tasks::{find_project_task, TaskApi, STOP_REASON};
+use super::tofu_modules::{
+    access_point_root, environment_cluster_name, environment_parameter_name, project_secret_name, task_family,
+    user_file_system_token, user_role_names,
+};
+use super::workspace::WorkspaceApi;
+
+/// The secret key holding the agent token (Task 4's payload).
+pub const AGENT_TOKEN_KEY: &str = "TRIPLEC_AGENT_TOKEN";
+/// A project secret is at most 64 KiB; anything bigger is not ours.
+const MAX_SECRET_READ: usize = 70_000;
+
+fn other(message: impl Into<String>) -> AwsError {
+    AwsError::Other {
+        message: message.into(),
+    }
+}
+
+pub trait RuntimeApi: Send + Sync {
+    /// `ssm:GetParameter` of an environment's record; `None` when absent.
+    fn environment_record(
+        &self,
+        env: &str,
+    ) -> impl Future<Output = Result<Option<String>, AwsError>> + Send;
+    /// `iam:GetRole`.
+    fn role_exists(&self, name: &str) -> impl Future<Output = Result<Knowable, AwsError>> + Send;
+    /// `secretsmanager:GetSecretValue`'s `SecretString`.
+    fn secret_string(&self, name: &str) -> impl Future<Output = Result<String, AwsError>> + Send;
+    /// The access point's `LifeCycleState`; `None` when it is gone.
+    fn access_point_state(
+        &self,
+        id: &str,
+    ) -> impl Future<Output = Result<Option<String>, AwsError>> + Send;
+    /// Delete at once (`ForceDeleteWithoutRecovery`, ruling R10): a secret
+    /// left pending deletion would make the project's next start fail, and
+    /// the app rebuilds it from local data. A secret that does not exist is
+    /// success.
+    fn delete_secret(&self, name: &str) -> impl Future<Output = Result<(), AwsError>> + Send;
+    /// A missing access point is success.
+    fn delete_access_point(&self, id: &str) -> impl Future<Output = Result<(), AwsError>> + Send;
+}
+
+// ------------------------------------------------------------ environment
+
+/// The environment's record, read with one `GetParameter` and validated.
+pub async fn read_environment<R: RuntimeApi>(
+    rt: &R,
+    env: &str,
+    account: &str,
+    region: &str,
+) -> Result<EnvironmentInfo, AwsError> {
+    let value = rt.environment_record(env).await?.ok_or_else(|| {
+        other(format!(
+            "The environment \"{env}\" was not found in {region}. It may have been removed; \
+             check Settings → Hosts."
+        ))
+    })?;
+    parse_environment_record(env, &value, account, region).map_err(|e| {
+        other(format!(
+            "The record of environment \"{env}\" in {region} is not usable: {e}"
+        ))
+    })
+}
+
+/// Whether the caller's task role exists in the environment: the onboarding
+/// signal a workspace user can read. A denied lookup is not an answer, so
+/// it is let through (RunTask will say what is wrong).
+pub async fn check_onboarded<R: RuntimeApi>(
+    rt: &R,
+    env: &str,
+    owner_key: &str,
+) -> Result<(), AwsError> {
+    let (task_role, _) = user_role_names(env, owner_key);
+    match rt.role_exists(&task_role).await? {
+        Knowable::No => Err(other(format!(
+            "You have not joined the environment \"{env}\" yet. Join it in Settings → Hosts \
+             (or ask an administrator to onboard you), then start the project again."
+        ))),
+        Knowable::Yes | Knowable::Unknown => Ok(()),
+    }
+}
+
+/// The agent token in a project secret's JSON. The error never echoes the
+/// secret.
+pub fn agent_token_from_secret(json: &str) -> Result<String, String> {
+    if json.len() > MAX_SECRET_READ {
+        return Err("The project secret is larger than a project secret can be".into());
+    }
+    let v: serde_json::Value = serde_json::from_str(json)
+        .map_err(|_| "The project secret is not a JSON object".to_string())?;
+    v.get(AGENT_TOKEN_KEY)
+        .and_then(|t| t.as_str())
+        .filter(|t| !t.is_empty() && t.bytes().all(|b| b.is_ascii_graphic()))
+        .map(str::to_string)
+        .ok_or_else(|| "The project secret holds no agent token".to_string())
+}
+
+/// The token a running task of this project started with (P2: the caller
+/// may read their own secret; `prepare_workspace` wrote it before RunTask).
+pub async fn read_agent_token<R: RuntimeApi>(
+    rt: &R,
+    env: &str,
+    owner_key: &str,
+    project_id: &str,
+) -> Result<String, AwsError> {
+    let name = project_secret_name(env, owner_key, project_id);
+    let json = rt.secret_string(&name).await?;
+    agent_token_from_secret(&json).map_err(other)
+}
+
+/// After a start this call ran is up and its agent answered with `ours`:
+/// make sure the secret still holds `ours`. A start that lost the RunTask
+/// race (another machine, the same moment) rotated the token in the secret
+/// before it found this task, and every later attach would read a token the
+/// task never saw. Returns whether the secret had to be put back.
+pub async fn ensure_agent_token<W: WorkspaceApi, R: RuntimeApi>(
+    work: &W,
+    rt: &R,
+    env: &EnvironmentInfo,
+    owner_user_id: &str,
+    owner_key: &str,
+    project_id: &str,
+    ours: &str,
+) -> Result<bool, AwsError> {
+    let name = project_secret_name(&env.name, owner_key, project_id);
+    let json = rt.secret_string(&name).await?;
+    if agent_token_from_secret(&json).ok().as_deref() == Some(ours) {
+        return Ok(false);
+    }
+    let mut v: serde_json::Map<String, serde_json::Value> = serde_json::from_str(&json)
+        .map_err(|_| other("The project secret is not a JSON object"))?;
+    v.insert(AGENT_TOKEN_KEY.to_string(), serde_json::Value::String(ours.to_string()));
+    let repaired = serde_json::to_string(&v).map_err(|e| other(e.to_string()))?;
+    let tags = super::workspace::workspace_tags(owner_user_id, project_id, &env.name);
+    work.put_project_secret(&name, &env.kms_key_arn, &repaired, &tags).await?;
+    Ok(true)
+}
+
+/// How long a fresh access point may take to become `available`.
+#[derive(Debug, Clone, Copy)]
+pub struct PollTiming {
+    pub interval: Duration,
+    pub timeout: Duration,
+}
+
+impl Default for PollTiming {
+    fn default() -> Self {
+        PollTiming {
+            interval: Duration::from_secs(2),
+            timeout: Duration::from_secs(90),
+        }
+    }
+}
+
+/// Wait until the access point is `available` (a task mounting one that is
+/// still `creating` fails to start).
+pub async fn wait_access_point<R: RuntimeApi>(
+    rt: &R,
+    id: &str,
+    timing: PollTiming,
+) -> Result<(), AwsError> {
+    let deadline = tokio::time::Instant::now() + timing.timeout;
+    loop {
+        match rt.access_point_state(id).await?.as_deref() {
+            Some("available") => return Ok(()),
+            Some("creating") | Some("updating") => {}
+            Some(s) => {
+                return Err(other(format!(
+                    "The project's EFS access point {id} is {s}; start the project again"
+                )))
+            }
+            None => {
+                return Err(other(format!(
+                    "The project's EFS access point {id} disappeared; start the project again"
+                )))
+            }
+        }
+        if tokio::time::Instant::now() + timing.interval > deadline {
+            return Err(other(format!(
+                "The project's EFS access point {id} did not become available in time; \
+                 start the project again in a minute"
+            )));
+        }
+        tokio::time::sleep(timing.interval).await;
+    }
+}
+
+// ------------------------------------------------------------------ ARNs
+
+/// The cluster *name* of `arn:...:task/<cluster>/<id>` (ECS accepts a name
+/// wherever it takes a cluster).
+pub fn cluster_of_task(task_arn: &str) -> Option<&str> {
+    let (_, rest) = task_arn.split_once(":task/")?;
+    let (cluster, id) = rest.split_once('/')?;
+    (task_arn.starts_with("arn:") && !cluster.is_empty() && !id.is_empty() && !id.contains('/'))
+        .then_some(cluster)
+}
+
+/// The cluster ARN of a task ARN (same partition, region and account).
+pub fn cluster_arn_of_task(task_arn: &str) -> Option<String> {
+    let cluster = cluster_of_task(task_arn)?;
+    let (prefix, _) = task_arn.split_once(":task/")?;
+    Some(format!("{prefix}:cluster/{cluster}"))
+}
+
+// ---------------------------------------------------------------- removal
+
+/// What removing a project's AWS resources needs to know.
+pub struct RemoveRequest<'a> {
+    pub env: &'a str,
+    pub region: &'a str,
+    pub owner_user_id: &'a str,
+    pub owner_key: &'a str,
+    pub project_id: &'a str,
+    /// The task ARN the store has, if any (stopped too, in case the listing
+    /// missed it).
+    pub stored_task_arn: Option<&'a str>,
+    pub stored_access_point_id: Option<&'a str>,
+    /// Delete the EFS access point (ruling R9). The files stay on the
+    /// user's own file system (only their task role can read it) until
+    /// offboarding destroys it; a later start of the same project gets a new
+    /// access point onto the same directory.
+    pub discard_data: bool,
+}
+
+/// Stop the project's task, delete its secret (no recovery window, R10) and,
+/// with `discard_data`, delete its access point (not the files, R9). Task definition revisions
+/// are left registered (R8). A task that can't be stopped stops the removal (nothing
+/// billed may be left running); the rest is attempted in full and every
+/// failure reported.
+pub async fn remove_workspace_resources<T: TaskApi, W: WorkspaceApi, R: RuntimeApi>(
+    tasks: &T,
+    work: &W,
+    rt: &R,
+    req: &RemoveRequest<'_>,
+) -> Result<(), AwsError> {
+    let cluster = environment_cluster_name(req.env);
+    let family = task_family(req.env, req.owner_key, req.project_id);
+
+    // 1. The task.
+    let live =
+        find_project_task(tasks, &cluster, &family, req.owner_user_id, req.project_id).await?;
+    let mut to_stop: Vec<String> = live.into_iter().map(|t| t.arn).collect();
+    if let Some(arn) = req.stored_task_arn {
+        if cluster_of_task(arn) == Some(cluster.as_str()) && !to_stop.iter().any(|a| a == arn) {
+            to_stop.push(arn.to_string());
+        }
+    }
+    for arn in &to_stop {
+        tasks.stop_task(&cluster, arn, STOP_REASON).await?;
+    }
+
+    let mut failures: Vec<String> = Vec::new();
+
+    // 2. Task definition revisions are left ACTIVE (ruling R8): ECS
+    // authorizes `DeregisterTaskDefinition` against `*` only, with no tag
+    // condition, so the workspace tier can't retire just its own. They are
+    // inert (no secret values, only the secret's ARN) and free, and
+    // `RunOwnTasks` still requires the owner tag, so nobody else can run
+    // them. An admin can deregister them (`aws/README.md`).
+    log::info!(
+        "Project {}: its task definition revisions ({family}:*) are left registered; an \
+         administrator can deregister them",
+        req.project_id
+    );
+
+    // 3. The secret.
+    let secret = project_secret_name(req.env, req.owner_key, req.project_id);
+    if let Err(e) = rt.delete_secret(&secret).await {
+        failures.push(format!("secret {secret}: {e}"));
+    }
+
+    // 4. The access point, only when asked.
+    if req.discard_data {
+        let mut ids: Vec<String> = req.stored_access_point_id.map(String::from).into_iter().collect();
+        let token = user_file_system_token(req.env, req.owner_key);
+        match work.find_file_system(&token).await {
+            Ok(Some(fs)) if fs.owner.as_deref() == Some(req.owner_user_id) => {
+                let root = access_point_root(req.owner_key, req.project_id);
+                match work.access_points(&fs.id).await {
+                    Ok(points) => ids.extend(
+                        points
+                            .into_iter()
+                            .filter(|a| {
+                                a.file_system_id == fs.id
+                                    && a.root_path.as_deref() == Some(root.as_str())
+                                    && a.owner.as_deref() == Some(req.owner_user_id)
+                                    && a.project.as_deref() == Some(req.project_id)
+                            })
+                            .map(|a| a.id),
+                    ),
+                    Err(e) => failures.push(format!("access points: {e}")),
+                }
+            }
+            Ok(_) => {}
+            Err(e) => failures.push(format!("file system: {e}")),
+        }
+        ids.sort();
+        ids.dedup();
+        for id in ids {
+            if let Err(e) = rt.delete_access_point(&id).await {
+                failures.push(format!("access point {id}: {e}"));
+            }
+        }
+    }
+
+    if failures.is_empty() {
+        Ok(())
+    } else {
+        Err(other(format!(
+            "Some of the project's AWS resources in {} could not be removed: {}",
+            req.region,
+            failures.join("; ")
+        )))
+    }
+}
+
+// ---------------------------------------------------------------- real API
+
+pub struct SdkRuntimeApi {
+    ssm: aws_sdk_ssm::Client,
+    iam: aws_sdk_iam::Client,
+    secrets: aws_sdk_secretsmanager::Client,
+    efs: aws_sdk_efs::Client,
+}
+
+impl SdkRuntimeApi {
+    pub fn new(cfg: &SdkConfig) -> Self {
+        SdkRuntimeApi {
+            ssm: aws_sdk_ssm::Client::new(cfg),
+            iam: aws_sdk_iam::Client::new(cfg),
+            secrets: aws_sdk_secretsmanager::Client::new(cfg),
+            efs: aws_sdk_efs::Client::new(cfg),
+        }
+    }
+}
+
+impl RuntimeApi for SdkRuntimeApi {
+    async fn environment_record(&self, env: &str) -> Result<Option<String>, AwsError> {
+        const ACTION: &str = "ssm:GetParameter";
+        match self
+            .ssm
+            .get_parameter()
+            .name(environment_parameter_name(env))
+            .with_decryption(false)
+            .send()
+            .await
+        {
+            Ok(out) => Ok(out.parameter().and_then(|p| p.value()).map(str::to_string)),
+            Err(e)
+                if e.as_service_error()
+                    .is_some_and(|s| s.is_parameter_not_found()) =>
+            {
+                Ok(None)
+            }
+            Err(e) => Err(classify_sdk_error(ACTION, &e)),
+        }
+    }
+
+    async fn role_exists(&self, name: &str) -> Result<Knowable, AwsError> {
+        let res = self.iam.get_role().role_name(name).send().await;
+        knowable("iam:GetRole", res)
+    }
+
+    async fn secret_string(&self, name: &str) -> Result<String, AwsError> {
+        const ACTION: &str = "secretsmanager:GetSecretValue";
+        let out = self
+            .secrets
+            .get_secret_value()
+            .secret_id(name)
+            .send()
+            .await
+            .map_err(|e| classify_sdk_error(ACTION, &e))?;
+        out.secret_string()
+            .map(str::to_string)
+            .ok_or_else(|| other(format!("{ACTION} returned no SecretString")))
+    }
+
+    async fn access_point_state(&self, id: &str) -> Result<Option<String>, AwsError> {
+        const ACTION: &str = "elasticfilesystem:DescribeAccessPoints";
+        match self.efs.describe_access_points().access_point_id(id).send().await {
+            Ok(out) => Ok(out
+                .access_points()
+                .iter()
+                .find(|a| a.access_point_id() == Some(id))
+                .and_then(|a| a.life_cycle_state())
+                .map(|s| s.as_str().to_string())),
+            Err(e)
+                if e.as_service_error()
+                    .is_some_and(|s| s.is_access_point_not_found()) =>
+            {
+                Ok(None)
+            }
+            Err(e) => Err(classify_sdk_error(ACTION, &e)),
+        }
+    }
+
+    async fn delete_secret(&self, name: &str) -> Result<(), AwsError> {
+        const ACTION: &str = "secretsmanager:DeleteSecret";
+        match self
+            .secrets
+            .delete_secret()
+            .secret_id(name)
+            .force_delete_without_recovery(true)
+            .send()
+            .await
+        {
+            Ok(_) => Ok(()),
+            Err(e)
+                if e.as_service_error()
+                    .is_some_and(|s| s.is_resource_not_found_exception()) =>
+            {
+                Ok(())
+            }
+            // Scheduled by an older version of the app and AWS refused the
+            // forced delete: nothing more this tier may do (no RestoreSecret).
+            Err(e)
+                if e.as_service_error().is_some_and(|s| {
+                    s.is_invalid_request_exception()
+                        && s.message().is_some_and(|m| m.contains("scheduled for deletion"))
+                }) =>
+            {
+                Ok(())
+            }
+            Err(e) => Err(classify_sdk_error(ACTION, &e)),
+        }
+    }
+
+    async fn delete_access_point(&self, id: &str) -> Result<(), AwsError> {
+        const ACTION: &str = "elasticfilesystem:DeleteAccessPoint";
+        match self.efs.delete_access_point().access_point_id(id).send().await {
+            Ok(_) => Ok(()),
+            Err(e)
+                if e.as_service_error()
+                    .is_some_and(|s| s.is_access_point_not_found()) =>
+            {
+                Ok(())
+            }
+            Err(e) => Err(classify_sdk_error(ACTION, &e)),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;

app/src-tauri/src/aws/runtime/tests.rs

@@ -0,0 +1,331 @@
+use std::sync::Mutex;
+
+use aws_sdk_ecs::operation::register_task_definition::RegisterTaskDefinitionInput;
+use aws_sdk_ecs::operation::run_task::RunTaskInput;
+
+use super::*;
+use crate::aws::tasks::TaskInfo;
+use crate::aws::tofu_modules::owner_key;
+use crate::aws::workspace::{AccessPointRef, FileSystemRef, TaskDefinitionRef};
+
+const REGION: &str = "eu-west-1";
+const ACCOUNT: &str = "111122223333";
+const USER: &str = "AROAEXAMPLEID:alice@example.com";
+const PROJECT: &str = "0f1e2d3c-4b5a-6978-8796-a5b4c3d2e1f0";
+
+fn ok() -> String {
+    owner_key(REGION, USER)
+}
+
+fn family() -> String {
+    task_family("dev", &ok(), PROJECT)
+}
+
+fn task_arn(id: &str) -> String {
+    format!("arn:aws:ecs:{REGION}:{ACCOUNT}:task/triple-c-dev/{id}")
+}
+
+#[derive(Default)]
+struct Fake {
+    calls: Mutex<Vec<String>>,
+    record: Option<String>,
+    role: Option<Knowable>,
+    secret: Option<String>,
+    ap_states: Mutex<Vec<Option<String>>>,
+    live_tasks: Vec<TaskInfo>,
+    revisions: Vec<TaskDefinitionRef>,
+    access_points: Vec<AccessPointRef>,
+    fail_secret_delete: bool,
+}
+
+impl Fake {
+    fn log(&self, s: String) {
+        self.calls.lock().unwrap().push(s);
+    }
+    fn calls(&self) -> Vec<String> {
+        self.calls.lock().unwrap().clone()
+    }
+}
+
+impl RuntimeApi for Fake {
+    async fn environment_record(&self, env: &str) -> Result<Option<String>, AwsError> {
+        self.log(format!("record {env}"));
+        Ok(self.record.clone())
+    }
+    async fn role_exists(&self, name: &str) -> Result<Knowable, AwsError> {
+        self.log(format!("role {name}"));
+        Ok(self.role.clone().unwrap_or(Knowable::Yes))
+    }
+    async fn secret_string(&self, name: &str) -> Result<String, AwsError> {
+        self.log(format!("secret {name}"));
+        self.secret.clone().ok_or_else(|| other("no secret"))
+    }
+    async fn access_point_state(&self, id: &str) -> Result<Option<String>, AwsError> {
+        self.log(format!("ap {id}"));
+        let mut s = self.ap_states.lock().unwrap();
+        Ok(if s.len() > 1 { s.remove(0) } else { s.first().cloned().flatten() })
+    }
+    async fn delete_secret(&self, name: &str) -> Result<(), AwsError> {
+        self.log(format!("delete-secret {name}"));
+        if self.fail_secret_delete {
+            return Err(other("denied"));
+        }
+        Ok(())
+    }
+    async fn delete_access_point(&self, id: &str) -> Result<(), AwsError> {
+        self.log(format!("delete-ap {id}"));
+        Ok(())
+    }
+}
+
+impl TaskApi for Fake {
+    async fn run_task(&self, _req: RunTaskInput) -> Result<TaskInfo, AwsError> {
+        unreachable!("removal never runs a task")
+    }
+    async fn describe(&self, _c: &str, arns: &[String]) -> Result<Vec<TaskInfo>, AwsError> {
+        Ok(self.live_tasks.iter().filter(|t| arns.contains(&t.arn)).cloned().collect())
+    }
+    async fn list_project_tasks(&self, _c: &str, _f: &str) -> Result<Vec<String>, AwsError> {
+        Ok(self.live_tasks.iter().map(|t| t.arn.clone()).collect())
+    }
+    async fn stop_task(&self, cluster: &str, arn: &str, reason: &str) -> Result<(), AwsError> {
+        self.log(format!("stop {cluster} {arn} {reason}"));
+        Ok(())
+    }
+    async fn log_tail(&self, _g: &str, _s: &str, _l: i32) -> Result<Vec<String>, AwsError> {
+        Ok(Vec::new())
+    }
+}
+
+impl WorkspaceApi for Fake {
+    async fn find_file_system(&self, _token: &str) -> Result<Option<FileSystemRef>, AwsError> {
+        Ok(Some(FileSystemRef { id: "fs-1".into(), owner: Some(USER.into()) }))
+    }
+    async fn access_points(&self, _fs: &str) -> Result<Vec<AccessPointRef>, AwsError> {
+        Ok(self.access_points.clone())
+    }
+    async fn create_access_point(
+        &self,
+        _fs: &str,
+        _root: &str,
+        _tags: &[(String, String)],
+    ) -> Result<String, AwsError> {
+        unreachable!()
+    }
+    async fn put_project_secret(
+        &self,
+        _n: &str,
+        _k: &str,
+        _j: &str,
+        _t: &[(String, String)],
+    ) -> Result<String, AwsError> {
+        unreachable!()
+    }
+    async fn task_definition_revisions(&self, _f: &str) -> Result<Vec<String>, AwsError> {
+        Ok(self.revisions.iter().map(|r| r.arn.clone()).collect())
+    }
+    async fn describe_task_definition(
+        &self,
+        arn: &str,
+    ) -> Result<Option<TaskDefinitionRef>, AwsError> {
+        Ok(self.revisions.iter().find(|r| r.arn == arn).cloned())
+    }
+    async fn register_task_definition(
+        &self,
+        _req: RegisterTaskDefinitionInput,
+    ) -> Result<String, AwsError> {
+        unreachable!()
+    }
+}
+
+fn record() -> String {
+    serde_json::json!({
+        "schema": 1, "name": "dev", "template_version": 1,
+        "cluster_arn": format!("arn:aws:ecs:{REGION}:{ACCOUNT}:cluster/triple-c-dev"),
+        "security_group_id": "sg-0123456789abcdef0",
+        "subnet_ids": ["subnet-0a", "subnet-0b"],
+        "assign_public_ip": true,
+        "kms_key_arn": format!("arn:aws:kms:{REGION}:{ACCOUNT}:key/1234-abcd"),
+        "log_group": "/triple-c/dev", "network_mode": "public", "tenancy": "strict"
+    })
+    .to_string()
+}
+
+#[tokio::test]
+async fn the_environment_is_read_with_one_lookup_and_validated() {
+    let fake = Fake { record: Some(record()), ..Default::default() };
+    let env = read_environment(&fake, "dev", ACCOUNT, REGION).await.unwrap();
+    assert_eq!(env.log_group, "/triple-c/dev");
+    assert_eq!(fake.calls(), vec!["record dev"]);
+
+    let missing = Fake::default();
+    let e = read_environment(&missing, "dev", ACCOUNT, REGION).await.unwrap_err();
+    assert!(e.to_string().contains("was not found"), "{e}");
+
+    // A record from another account is refused, by field name only.
+    let foreign = Fake { record: Some(record()), ..Default::default() };
+    let e = read_environment(&foreign, "dev", "999999999999", REGION).await.unwrap_err();
+    assert!(e.to_string().contains("cluster_arn"), "{e}");
+}
+
+#[tokio::test]
+async fn a_missing_task_role_means_not_joined_and_a_denied_lookup_lets_the_start_try() {
+    let no = Fake { role: Some(Knowable::No), ..Default::default() };
+    let e = check_onboarded(&no, "dev", &ok()).await.unwrap_err();
+    assert!(e.to_string().contains("not joined"), "{e}");
+    assert_eq!(no.calls(), vec![format!("role triple-c-dev-{}-task", ok())]);
+    let unknown = Fake { role: Some(Knowable::Unknown), ..Default::default() };
+    assert!(check_onboarded(&unknown, "dev", &ok()).await.is_ok());
+}
+
+#[test]
+fn the_agent_token_is_read_from_the_secret_without_echoing_it() {
+    let json = r#"{"TRIPLEC_AGENT_TOKEN":"abc-DEF_123","OTHER":"SENTINEL-VALUE-7f3a"}"#;
+    assert_eq!(agent_token_from_secret(json).unwrap(), "abc-DEF_123");
+    for bad in [
+        r#"{"OTHER":"SENTINEL-VALUE-7f3a"}"#,
+        r#"{"TRIPLEC_AGENT_TOKEN":""}"#,
+        r#"{"TRIPLEC_AGENT_TOKEN":"has space"}"#,
+        "SENTINEL-VALUE-7f3a",
+    ] {
+        let e = agent_token_from_secret(bad).unwrap_err();
+        assert!(!e.contains("SENTINEL") && !e.contains("space"), "{e}");
+    }
+}
+
+#[tokio::test]
+async fn the_token_comes_from_the_projects_own_secret() {
+    let fake = Fake {
+        secret: Some(r#"{"TRIPLEC_AGENT_TOKEN":"tok"}"#.into()),
+        ..Default::default()
+    };
+    assert_eq!(read_agent_token(&fake, "dev", &ok(), PROJECT).await.unwrap(), "tok");
+    assert_eq!(fake.calls(), vec![format!("secret triple-c/dev/{}/{PROJECT}", ok())]);
+}
+
+#[tokio::test(start_paused = true)]
+async fn a_new_access_point_is_waited_for_until_available() {
+    let fake = Fake {
+        ap_states: Mutex::new(vec![Some("creating".into()), Some("creating".into()), Some("available".into())]),
+        ..Default::default()
+    };
+    wait_access_point(&fake, "fsap-1", PollTiming::default()).await.unwrap();
+    assert_eq!(fake.calls().len(), 3);
+
+    let stuck = Fake { ap_states: Mutex::new(vec![Some("creating".into())]), ..Default::default() };
+    let e = wait_access_point(&stuck, "fsap-1", PollTiming::default()).await.unwrap_err();
+    assert!(e.to_string().contains("did not become available"), "{e}");
+
+    let gone = Fake { ap_states: Mutex::new(vec![Some("deleting".into())]), ..Default::default() };
+    assert!(wait_access_point(&gone, "fsap-1", PollTiming::default()).await.is_err());
+}
+
+#[test]
+fn task_arns_name_their_cluster() {
+    let arn = task_arn("abc123");
+    assert_eq!(cluster_of_task(&arn), Some("triple-c-dev"));
+    assert_eq!(
+        cluster_arn_of_task(&arn).as_deref(),
+        Some(format!("arn:aws:ecs:{REGION}:{ACCOUNT}:cluster/triple-c-dev").as_str())
+    );
+    assert_eq!(cluster_of_task("arn:aws:ecs:r:a:task/abc"), None, "old format, no cluster");
+    assert_eq!(cluster_of_task("task/triple-c-dev/abc"), None);
+    assert_eq!(cluster_of_task("arn:aws:ecs:r:a:task/c/a/b"), None);
+}
+
+fn live(id: &str) -> TaskInfo {
+    TaskInfo {
+        arn: task_arn(id),
+        last_status: "RUNNING".into(),
+        desired_status: "RUNNING".into(),
+        health: None,
+        stop_code: None,
+        stopped_reason: None,
+        task_definition_arn: format!(
+            "arn:aws:ecs:{REGION}:{ACCOUNT}:task-definition/{}:2",
+            family()
+        ),
+        runtime_id: None,
+        exec_agent_running: false,
+        exit_code: None,
+        owner: Some(USER.into()),
+        project: Some(PROJECT.into()),
+    }
+}
+
+fn rev(n: u32, owner: &str) -> TaskDefinitionRef {
+    TaskDefinitionRef {
+        arn: format!("arn:aws:ecs:{REGION}:{ACCOUNT}:task-definition/{}:{n}", family()),
+        family: family(),
+        owner: Some(owner.into()),
+        project: Some(PROJECT.into()),
+        fingerprint: None,
+    }
+}
+
+#[tokio::test]
+async fn removal_stops_the_task_leaves_the_revisions_and_schedules_the_secret() {
+    let fake = Fake {
+        live_tasks: vec![live("t1")],
+        revisions: vec![rev(2, USER), rev(3, "AROAOTHER:mallory"), rev(1, USER)],
+        access_points: vec![AccessPointRef {
+            id: "fsap-found".into(),
+            file_system_id: "fs-1".into(),
+            root_path: Some(access_point_root(&ok(), PROJECT)),
+            owner: Some(USER.into()),
+            project: Some(PROJECT.into()),
+            state: Some("available".into()),
+        }],
+        ..Default::default()
+    };
+    let key = ok();
+    let t0 = task_arn("t0");
+    let mut r = RemoveRequest {
+        env: "dev",
+        region: REGION,
+        owner_user_id: USER,
+        owner_key: &key,
+        project_id: PROJECT,
+        stored_task_arn: Some(&t0),
+        stored_access_point_id: Some("fsap-stored"),
+        discard_data: false,
+    };
+    remove_workspace_resources(&fake, &fake, &fake, &r).await.unwrap();
+    let calls = fake.calls();
+    let secret = project_secret_name("dev", &ok(), PROJECT);
+    assert_eq!(
+        calls,
+        vec![
+            format!("stop triple-c-dev {} {STOP_REASON}", task_arn("t1")),
+            format!("stop triple-c-dev {} {STOP_REASON}", task_arn("t0")),
+            format!("delete-secret {secret}"),
+        ],
+        "no task definition is touched (R8) and the access point is kept"
+    );
+
+    let keep = Fake { access_points: fake.access_points.clone(), ..Default::default() };
+    r.discard_data = true;
+    remove_workspace_resources(&keep, &keep, &keep, &r).await.unwrap();
+    let calls = keep.calls();
+    assert!(calls.contains(&"delete-ap fsap-found".to_string()), "{calls:?}");
+    assert!(calls.contains(&"delete-ap fsap-stored".to_string()), "{calls:?}");
+}
+
+#[tokio::test]
+async fn a_failed_step_is_reported_but_the_rest_still_runs() {
+    let fake = Fake { fail_secret_delete: true, ..Default::default() };
+    let key = ok();
+    let r = RemoveRequest {
+        env: "dev",
+        region: REGION,
+        owner_user_id: USER,
+        owner_key: &key,
+        project_id: PROJECT,
+        stored_task_arn: None,
+        stored_access_point_id: Some("fsap-1"),
+        discard_data: true,
+    };
+    let e = remove_workspace_resources(&fake, &fake, &fake, &r).await.unwrap_err();
+    assert!(e.to_string().contains("secret"), "{e}");
+    assert!(fake.calls().contains(&"delete-ap fsap-1".to_string()));
+}

app/src-tauri/src/aws/tasks.rs

@@ -0,0 +1,695 @@
+//! A project's ECS task: find the one already running, or run one; wait
+//! until it is ready; stop it; and read why it stopped.
+//!
+//! **A task is trusted by its tags, not its family.** Family names are built
+//! from a 12-character id prefix and any workspace user may register into any
+//! `triple-c-*` family, so a task listed under the project's family is reused
+//! only when DescribeTasks shows the caller's own `triple-c:owner` (which only
+//! the caller can set, at RunTask) and this project's `triple-c:project`.
+//!
+//! **RunTask names an exact revision.** Never a bare family: "the latest
+//! revision" of a family is whatever anyone registered last.
+//!
+//! **A quota refusal is final.** Fargate's vCPU limit (and its kin) surface as
+//! [`AwsError::QuotaExceeded`] with a message saying what to do; nothing here
+//! retries a RunTask, and the SDK's own retries are made idempotent by a
+//! client token.
+
+use std::future::Future;
+use std::time::Duration;
+
+use aws_config::SdkConfig;
+use aws_sdk_ecs::operation::run_task::RunTaskInput;
+use aws_sdk_ecs::types::{
+    AssignPublicIp, AwsVpcConfiguration, CapacityProviderStrategyItem, DesiredStatus, LaunchType,
+    ManagedAgentName, NetworkConfiguration, Tag, Task, TaskField,
+};
+
+use super::environments::EnvironmentInfo;
+use super::error::{classify_sdk_error, AwsError};
+pub use super::tofu_modules::task_log_stream;
+use super::workspace::{workspace_tags, CONTAINER_NAME, TAG_OWNER, TAG_PROJECT};
+
+/// The `reason` StopTask records when the app stops a task.
+pub const STOP_REASON: &str = "Stopped from Triple-C";
+/// Log lines shown when a task stops before it is ready.
+pub const LOG_TAIL_LINES: i32 = 50;
+const SPOT_PROVIDER: &str = "FARGATE_SPOT";
+/// DescribeTasks takes at most 100 tasks per call.
+const DESCRIBE_BATCH: usize = 100;
+/// ListTasks pages read per status; a project has one task, so this is slack.
+const MAX_LIST_PAGES: usize = 5;
+
+fn other(message: impl Into<String>) -> AwsError {
+    AwsError::Other {
+        message: message.into(),
+    }
+}
+
+/// What the app needs to know about a task.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct TaskInfo {
+    pub arn: String,
+    /// `PROVISIONING`, `PENDING`, `ACTIVATING`, `RUNNING`, `DEACTIVATING`,
+    /// `STOPPING`, `DEPROVISIONING`, `STOPPED`.
+    pub last_status: String,
+    pub desired_status: String,
+    /// `HEALTHY`, `UNHEALTHY`, `UNKNOWN`.
+    pub health: Option<String>,
+    /// ECS `stopCode` (`EssentialContainerExited`, `SpotInterruption`, ...).
+    pub stop_code: Option<String>,
+    pub stopped_reason: Option<String>,
+    pub task_definition_arn: String,
+    /// The `workspace` container's runtime id (needed for an SSM target).
+    pub runtime_id: Option<String>,
+    /// The `workspace` container's ExecuteCommandAgent is RUNNING.
+    pub exec_agent_running: bool,
+    /// The `workspace` container's exit code, once it has one.
+    pub exit_code: Option<i32>,
+    /// Its `triple-c:owner` / `triple-c:project` tags (DescribeTasks with
+    /// TAGS; RunTask's answer carries the tags it was given).
+    pub owner: Option<String>,
+    pub project: Option<String>,
+}
+
+impl TaskInfo {
+    fn is_stopping(&self) -> bool {
+        self.last_status == "STOPPED" || self.desired_status == "STOPPED"
+    }
+    /// On its way up or up, and meant to stay that way.
+    fn is_live(&self) -> bool {
+        self.desired_status == "RUNNING"
+            && matches!(
+                self.last_status.as_str(),
+                "PROVISIONING" | "PENDING" | "ACTIVATING" | "RUNNING"
+            )
+    }
+    fn is_ready(&self) -> bool {
+        self.last_status == "RUNNING" && self.exec_agent_running && self.runtime_id.is_some()
+    }
+}
+
+fn tag_value(tags: &[Tag], key: &str) -> Option<String> {
+    tags.iter()
+        .find(|t| t.key() == Some(key))
+        .and_then(|t| t.value())
+        .map(str::to_string)
+}
+
+/// An SDK task as a [`TaskInfo`]. The container facts come from the
+/// `workspace` container only.
+pub(crate) fn task_info(t: &Task) -> TaskInfo {
+    let workspace = t
+        .containers()
+        .iter()
+        .find(|c| c.name() == Some(CONTAINER_NAME));
+    TaskInfo {
+        arn: t.task_arn().unwrap_or_default().to_string(),
+        last_status: t.last_status().unwrap_or_default().to_string(),
+        desired_status: t.desired_status().unwrap_or_default().to_string(),
+        health: t.health_status().map(|h| h.as_str().to_string()),
+        stop_code: t.stop_code().map(|c| c.as_str().to_string()),
+        stopped_reason: t.stopped_reason().map(str::to_string),
+        task_definition_arn: t.task_definition_arn().unwrap_or_default().to_string(),
+        runtime_id: workspace.and_then(|c| c.runtime_id()).map(str::to_string),
+        exec_agent_running: workspace.is_some_and(|c| {
+            c.managed_agents().iter().any(|a| {
+                a.name() == Some(&ManagedAgentName::ExecuteCommandAgent)
+                    && a.last_status() == Some("RUNNING")
+            })
+        }),
+        exit_code: workspace.and_then(|c| c.exit_code()),
+        owner: tag_value(t.tags(), TAG_OWNER),
+        project: tag_value(t.tags(), TAG_PROJECT),
+    }
+}
+
+/// What running and watching tasks asks AWS. Like `WorkspaceApi`, each
+/// method returns a `Send` future and an impl may write them as `async fn`;
+/// the decisions are made by the functions below, so a fake exercises them.
+pub trait TaskApi: Send + Sync {
+    /// RunTask. A quota refusal is [`AwsError::QuotaExceeded`].
+    fn run_task(
+        &self,
+        req: RunTaskInput,
+    ) -> impl Future<Output = Result<TaskInfo, AwsError>> + Send;
+    /// DescribeTasks (with tags). Tasks ECS no longer knows are left out.
+    fn describe(
+        &self,
+        cluster: &str,
+        arns: &[String],
+    ) -> impl Future<Output = Result<Vec<TaskInfo>, AwsError>> + Send;
+    /// ListTasks of exactly `family`, desired status RUNNING and PENDING.
+    fn list_project_tasks(
+        &self,
+        cluster: &str,
+        family: &str,
+    ) -> impl Future<Output = Result<Vec<String>, AwsError>> + Send;
+    fn stop_task(
+        &self,
+        cluster: &str,
+        arn: &str,
+        reason: &str,
+    ) -> impl Future<Output = Result<(), AwsError>> + Send;
+    /// The last `limit` lines of a log stream, oldest first. A stream (or
+    /// group) that does not exist is no lines, not an error.
+    fn log_tail(
+        &self,
+        group: &str,
+        stream: &str,
+        limit: i32,
+    ) -> impl Future<Output = Result<Vec<String>, AwsError>> + Send;
+}
+
+// ------------------------------------------------------------- run request
+
+/// The RunTask request: the exact revision, on the environment's cluster and
+/// network, with ECS Exec on and exactly the `tags` given (no propagation,
+/// no ECS-managed tags, no overrides — P1). Spot runs on the `FARGATE_SPOT`
+/// capacity provider with no launch type (the two are exclusive).
+pub fn run_task_request(
+    env: &EnvironmentInfo,
+    task_def_arn: &str,
+    spot: bool,
+    tags: &[(String, String)],
+) -> RunTaskInput {
+    const BUILT: &str = "every required field is set";
+    let mut req = RunTaskInput::builder()
+        .cluster(&env.cluster_arn)
+        .task_definition(task_def_arn)
+        .count(1)
+        .enable_execute_command(true)
+        .network_configuration(
+            NetworkConfiguration::builder()
+                .awsvpc_configuration(
+                    AwsVpcConfiguration::builder()
+                        .set_subnets(Some(env.subnet_ids.clone()))
+                        .security_groups(&env.security_group_id)
+                        .assign_public_ip(if env.assign_public_ip {
+                            AssignPublicIp::Enabled
+                        } else {
+                            AssignPublicIp::Disabled
+                        })
+                        .build()
+                        .expect(BUILT),
+                )
+                .build(),
+        )
+        .set_tags(Some(
+            tags.iter()
+                .map(|(k, v)| Tag::builder().key(k).value(v).build())
+                .collect(),
+        ))
+        // SDK retries of this call must not start a second task.
+        .client_token(uuid::Uuid::new_v4().to_string());
+    req = if spot {
+        req.capacity_provider_strategy(
+            CapacityProviderStrategyItem::builder()
+                .capacity_provider(SPOT_PROVIDER)
+                .weight(1)
+                .build()
+                .expect(BUILT),
+        )
+    } else {
+        req.launch_type(LaunchType::Fargate)
+    };
+    req.build().expect(BUILT)
+}
+
+/// The family of `arn:...:task-definition/<family>:<revision>`, when the
+/// revision is a number. `None` for a bare family or anything else.
+pub fn revision_family(arn: &str) -> Option<&str> {
+    if !arn.starts_with("arn:") {
+        return None;
+    }
+    let (_, rest) = arn.rsplit_once(":task-definition/")?;
+    let (family, rev) = rest.rsplit_once(':')?;
+    (!family.is_empty()
+        && !family.contains('/')
+        && !rev.is_empty()
+        && rev.bytes().all(|c| c.is_ascii_digit()))
+    .then_some(family)
+}
+
+// ------------------------------------------------------------- find or run
+
+/// The project's live task (provisioning through running, not being
+/// stopped), owned by the caller and tagged with this project. A RUNNING
+/// one is preferred.
+pub async fn find_project_task<A: TaskApi>(
+    api: &A,
+    cluster: &str,
+    family: &str,
+    owner_user_id: &str,
+    project_id: &str,
+) -> Result<Option<TaskInfo>, AwsError> {
+    let arns = api.list_project_tasks(cluster, family).await?;
+    if arns.is_empty() {
+        return Ok(None);
+    }
+    let mut mine: Vec<TaskInfo> = Vec::new();
+    for chunk in arns.chunks(DESCRIBE_BATCH) {
+        mine.extend(api.describe(cluster, chunk).await?.into_iter().filter(|t| {
+            t.owner.as_deref() == Some(owner_user_id)
+                && t.project.as_deref() == Some(project_id)
+                && revision_family(&t.task_definition_arn) == Some(family)
+                && t.is_live()
+        }));
+    }
+    mine.sort_by_key(|t| t.last_status != "RUNNING");
+    Ok(mine.into_iter().next())
+}
+
+/// What [`find_or_run`] did.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct TaskStart {
+    pub task: TaskInfo,
+    /// An existing task was found (nothing was run). Its agent token is the
+    /// one it started with — see [`find_project_task`] in the report for
+    /// why a caller should look before rotating the token.
+    pub reused: bool,
+}
+
+/// The project's live task if there is one (Review Focus 2: never a second
+/// task for a project), else RunTask with the exact `task_def_arn`.
+pub async fn find_or_run<A: TaskApi>(
+    api: &A,
+    env: &EnvironmentInfo,
+    owner_user_id: &str,
+    project_id: &str,
+    task_def_arn: &str,
+    spot: bool,
+) -> Result<TaskStart, AwsError> {
+    let family = revision_family(task_def_arn).ok_or_else(|| {
+        other(format!(
+            "\"{task_def_arn}\" is not an exact task definition revision"
+        ))
+    })?;
+    if !family.starts_with("triple-c-") {
+        return Err(other(format!(
+            "\"{task_def_arn}\" is not a Triple-C task definition"
+        )));
+    }
+    if let Some(task) =
+        find_project_task(api, &env.cluster_arn, family, owner_user_id, project_id).await?
+    {
+        return Ok(TaskStart { task, reused: true });
+    }
+    let tags = workspace_tags(owner_user_id, project_id, &env.name);
+    let task = api
+        .run_task(run_task_request(env, task_def_arn, spot, &tags))
+        .await?;
+    Ok(TaskStart {
+        task,
+        reused: false,
+    })
+}
+
+// ------------------------------------------------------------------ quotas
+
+/// Whether an AWS message says an account limit or quota was hit.
+pub fn looks_like_quota(text: &str) -> bool {
+    let t = text.to_lowercase();
+    [
+        "you've reached the limit",
+        "you\u{2019}ve reached the limit",
+        "limitexceeded",
+        "limit exceeded",
+        "quota",
+    ]
+    .iter()
+    .any(|s| t.contains(s))
+}
+
+/// The error for a RunTask refused on a quota.
+pub fn quota_error(detail: &str) -> AwsError {
+    AwsError::QuotaExceeded {
+        message: format!(
+            "AWS would not start the task because an account limit was reached: {detail}. \
+             Stop another workspace, or ask an administrator to raise the Fargate quota \
+             (Service Quotas, AWS Fargate) for this region. Triple-C does not retry."
+        ),
+    }
+}
+
+/// `e` as a quota error when its message is one; otherwise unchanged.
+pub fn quota_or(e: AwsError) -> AwsError {
+    match e {
+        AwsError::Other { ref message } if looks_like_quota(message) => quota_error(message),
+        e => e,
+    }
+}
+
+/// RunTask's answer: its one task, or an error from its `failures`
+/// (`(reason, detail)`), a quota one when they say so.
+pub fn run_task_outcome(
+    tasks: Vec<TaskInfo>,
+    failures: Vec<(Option<String>, Option<String>)>,
+) -> Result<TaskInfo, AwsError> {
+    if let Some(task) = tasks.into_iter().find(|t| !t.arn.is_empty()) {
+        return Ok(task);
+    }
+    let text = failures
+        .iter()
+        .map(|(r, d)| match (r, d) {
+            (Some(r), Some(d)) => format!("{r} ({d})"),
+            (Some(r), None) => r.clone(),
+            (None, Some(d)) => d.clone(),
+            (None, None) => "unknown failure".into(),
+        })
+        .collect::<Vec<_>>()
+        .join("; ");
+    if text.is_empty() {
+        return Err(other("ecs:RunTask returned no task and no failure"));
+    }
+    if looks_like_quota(&text) {
+        return Err(quota_error(&text));
+    }
+    Err(other(format!("ECS could not start the task: {text}")))
+}
+
+// -------------------------------------------------------------------- wait
+
+/// How [`wait_ready`] polls. Injectable so tests don't wait.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct WaitTiming {
+    pub interval: Duration,
+    pub timeout: Duration,
+}
+
+impl Default for WaitTiming {
+    fn default() -> Self {
+        WaitTiming {
+            interval: Duration::from_secs(5),
+            timeout: Duration::from_secs(6 * 60),
+        }
+    }
+}
+
+/// Where a project's task logs go: the environment's log group and the
+/// project's `awslogs-stream-prefix` (Task 4's `log_stream_prefix`).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct TaskLogs {
+    pub group: String,
+    pub stream_prefix: String,
+}
+
+fn describe_timeout(t: Duration) -> String {
+    let secs = t.as_secs();
+    if secs >= 60 && secs % 60 == 0 {
+        let m = secs / 60;
+        format!("{m} minute{}", if m == 1 { "" } else { "s" })
+    } else {
+        format!("{secs} seconds")
+    }
+}
+
+/// Poll until the task is RUNNING with its exec agent up and a runtime id
+/// (what an SSM session needs), calling `progress` with each look. A task
+/// that stops (or is being stopped) fails with its reason and the last
+/// [`LOG_TAIL_LINES`] lines of its log; one that never gets there fails
+/// after `timing.timeout` with its last status. The task is left as it is
+/// either way: stopping it is the caller's call.
+pub async fn wait_ready<A: TaskApi>(
+    api: &A,
+    cluster: &str,
+    arn: &str,
+    logs: &TaskLogs,
+    timing: WaitTiming,
+    progress: impl Fn(&TaskInfo),
+) -> Result<TaskInfo, AwsError> {
+    let deadline = tokio::time::Instant::now() + timing.timeout;
+    let wanted = [arn.to_string()];
+    loop {
+        let Some(t) = api
+            .describe(cluster, &wanted)
+            .await?
+            .into_iter()
+            .find(|t| t.arn == arn)
+        else {
+            return Err(other(format!(
+                "The task {arn} is no longer known to ECS; start the project again"
+            )));
+        };
+        progress(&t);
+        if t.is_stopping() {
+            return Err(stopped_error(api, logs, &t).await);
+        }
+        if t.is_ready() {
+            return Ok(t);
+        }
+        if tokio::time::Instant::now() + timing.interval > deadline {
+            return Err(other(format!(
+                "The task did not become ready within {} (last status {}{}). It may still \
+                 be starting; check the ECS console, or stop the project and start it again.",
+                describe_timeout(timing.timeout),
+                t.last_status,
+                if t.last_status == "RUNNING" && !t.exec_agent_running {
+                    ", ECS Exec agent not running yet"
+                } else {
+                    ""
+                }
+            )));
+        }
+        tokio::time::sleep(timing.interval).await;
+    }
+}
+
+async fn stopped_error<A: TaskApi>(api: &A, logs: &TaskLogs, t: &TaskInfo) -> AwsError {
+    let reason = t
+        .stopped_reason
+        .clone()
+        .unwrap_or_else(|| "no reason given".into());
+    let code = t
+        .stop_code
+        .as_deref()
+        .map(|c| format!(" ({c})"))
+        .unwrap_or_default();
+    let stream = task_log_stream(&logs.stream_prefix, &t.arn);
+    let tail = match api.log_tail(&logs.group, &stream, LOG_TAIL_LINES).await {
+        Ok(lines) if lines.is_empty() => "\n(The task wrote no log lines.)".to_string(),
+        Ok(lines) => format!("\nLast log lines:\n{}", lines.join("\n")),
+        Err(e) => format!("\n(Its log could not be read: {e})"),
+    };
+    other(format!(
+        "The task stopped before it was ready: {reason}{code}.{tail}"
+    ))
+}
+
+// ----------------------------------------------------------- stop / watch
+
+/// The entrypoint's exit status after an idle stop (`container/entrypoint.sh`,
+/// `stop_keepalive`). A stop from ECS (SIGTERM) exits 0; this one is distinct
+/// so an idle stop (`EssentialContainerExited`) is not mistaken for a crash.
+pub const IDLE_EXIT_CODE: i32 = 75;
+
+/// Why a task stopped, as the app reports it (spec, "Lifecycle and status").
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum StopKind {
+    /// Exited on its own (the essential container ended, or AWS retired it),
+    /// with ECS's stopped reason when it gave one.
+    Exited(Option<String>),
+    /// The workspace's own idle stop ([`IDLE_EXIT_CODE`]).
+    Idle,
+    /// A Fargate Spot interruption (P8).
+    Spot,
+    /// Never got going: the project goes to Error with this reason.
+    FailedToStart(String),
+    /// Stopped by someone (the app, the console, the CLI).
+    UserInitiated,
+}
+
+pub fn classify_stop(info: &TaskInfo) -> StopKind {
+    match info.stop_code.as_deref() {
+        Some("SpotInterruption") => StopKind::Spot,
+        Some("TaskFailedToStart") => StopKind::FailedToStart(
+            info.stopped_reason
+                .clone()
+                .filter(|r| !r.trim().is_empty())
+                .unwrap_or_else(|| "The task failed to start".into()),
+        ),
+        Some("UserInitiated") => StopKind::UserInitiated,
+        Some("EssentialContainerExited") if info.exit_code == Some(IDLE_EXIT_CODE) => StopKind::Idle,
+        _ => StopKind::Exited(info.stopped_reason.clone().filter(|r| !r.trim().is_empty())),
+    }
+}
+
+/// Of `arns`, the ones that are STOPPED or that ECS no longer knows (it
+/// forgets stopped tasks after about an hour), each with why it stopped (a
+/// forgotten task: [`StopKind::Exited`] without a reason). A task merely
+/// being stopped is not yet reported. For the AWS death watch.
+pub async fn stopped_among<A: TaskApi>(
+    api: &A,
+    cluster: &str,
+    arns: &[String],
+) -> Result<Vec<(String, StopKind)>, AwsError> {
+    let mut stopped = Vec::new();
+    for chunk in arns.chunks(DESCRIBE_BATCH) {
+        let known = api.describe(cluster, chunk).await?;
+        for arn in chunk {
+            match known.iter().find(|t| &t.arn == arn) {
+                Some(t) if t.last_status != "STOPPED" => {}
+                Some(t) => stopped.push((arn.clone(), classify_stop(t))),
+                None => stopped.push((arn.clone(), StopKind::Exited(None))),
+            }
+        }
+    }
+    Ok(stopped)
+}
+
+// ---------------------------------------------------------------- real API
+
+/// The real thing, from a connection's `SdkConfig`.
+pub struct SdkTaskApi {
+    ecs: aws_sdk_ecs::Client,
+    logs: aws_sdk_cloudwatchlogs::Client,
+}
+
+impl SdkTaskApi {
+    pub fn new(cfg: &SdkConfig) -> Self {
+        SdkTaskApi {
+            ecs: aws_sdk_ecs::Client::new(cfg),
+            logs: aws_sdk_cloudwatchlogs::Client::new(cfg),
+        }
+    }
+}
+
+impl TaskApi for SdkTaskApi {
+    async fn run_task(&self, req: RunTaskInput) -> Result<TaskInfo, AwsError> {
+        const ACTION: &str = "ecs:RunTask";
+        // The fluent builder takes no whole input; copy every field.
+        let out = self
+            .ecs
+            .run_task()
+            .set_capacity_provider_strategy(req.capacity_provider_strategy)
+            .set_cluster(req.cluster)
+            .set_count(req.count)
+            .set_enable_ecs_managed_tags(req.enable_ecs_managed_tags)
+            .set_enable_execute_command(req.enable_execute_command)
+            .set_group(req.group)
+            .set_launch_type(req.launch_type)
+            .set_network_configuration(req.network_configuration)
+            .set_overrides(req.overrides)
+            .set_placement_constraints(req.placement_constraints)
+            .set_placement_strategy(req.placement_strategy)
+            .set_platform_version(req.platform_version)
+            .set_propagate_tags(req.propagate_tags)
+            .set_reference_id(req.reference_id)
+            .set_started_by(req.started_by)
+            .set_tags(req.tags)
+            .set_task_definition(req.task_definition)
+            .set_client_token(req.client_token)
+            .set_volume_configurations(req.volume_configurations)
+            .send()
+            .await
+            .map_err(|e| quota_or(classify_sdk_error(ACTION, &e)))?;
+        run_task_outcome(
+            out.tasks().iter().map(task_info).collect(),
+            out.failures()
+                .iter()
+                .map(|f| (f.reason().map(String::from), f.detail().map(String::from)))
+                .collect(),
+        )
+    }
+
+    async fn describe(&self, cluster: &str, arns: &[String]) -> Result<Vec<TaskInfo>, AwsError> {
+        const ACTION: &str = "ecs:DescribeTasks";
+        let mut out = Vec::new();
+        for chunk in arns.chunks(DESCRIBE_BATCH) {
+            let page = self
+                .ecs
+                .describe_tasks()
+                .cluster(cluster)
+                .set_tasks(Some(chunk.to_vec()))
+                .include(TaskField::Tags)
+                .send()
+                .await
+                .map_err(|e| classify_sdk_error(ACTION, &e))?;
+            out.extend(page.tasks().iter().map(task_info));
+        }
+        Ok(out)
+    }
+
+    async fn list_project_tasks(
+        &self,
+        cluster: &str,
+        family: &str,
+    ) -> Result<Vec<String>, AwsError> {
+        const ACTION: &str = "ecs:ListTasks";
+        let mut found: Vec<String> = Vec::new();
+        for status in [DesiredStatus::Running, DesiredStatus::Pending] {
+            let mut token: Option<String> = None;
+            for _ in 0..MAX_LIST_PAGES {
+                let page = self
+                    .ecs
+                    .list_tasks()
+                    .cluster(cluster)
+                    .family(family)
+                    .desired_status(status.clone())
+                    .set_next_token(token.take())
+                    .send()
+                    .await
+                    .map_err(|e| classify_sdk_error(ACTION, &e))?;
+                for a in page.task_arns() {
+                    if !found.contains(a) {
+                        found.push(a.clone());
+                    }
+                }
+                match page.next_token() {
+                    Some(t) => token = Some(t.to_string()),
+                    None => break,
+                }
+            }
+        }
+        Ok(found)
+    }
+
+    async fn stop_task(&self, cluster: &str, arn: &str, reason: &str) -> Result<(), AwsError> {
+        const ACTION: &str = "ecs:StopTask";
+        self.ecs
+            .stop_task()
+            .cluster(cluster)
+            .task(arn)
+            .reason(reason)
+            .send()
+            .await
+            .map_err(|e| classify_sdk_error(ACTION, &e))?;
+        Ok(())
+    }
+
+    async fn log_tail(
+        &self,
+        group: &str,
+        stream: &str,
+        limit: i32,
+    ) -> Result<Vec<String>, AwsError> {
+        const ACTION: &str = "logs:GetLogEvents";
+        let out = self
+            .logs
+            .get_log_events()
+            .log_group_name(group)
+            .log_stream_name(stream)
+            .start_from_head(false)
+            .limit(limit)
+            .send()
+            .await;
+        match out {
+            Ok(page) => Ok(page
+                .events()
+                .iter()
+                .filter_map(|e| e.message())
+                .map(str::to_string)
+                .collect()),
+            Err(e)
+                if e.as_service_error()
+                    .is_some_and(|s| s.is_resource_not_found_exception()) =>
+            {
+                Ok(Vec::new())
+            }
+            Err(e) => Err(classify_sdk_error(ACTION, &e)),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;

app/src-tauri/src/aws/tasks/tests.rs

@@ -0,0 +1,744 @@
+use std::sync::Mutex;
+use std::time::Duration;
+
+use aws_sdk_ecs::types::{
+    AssignPublicIp, Container, LaunchType, ManagedAgent, ManagedAgentName, Tag, Task, TaskStopCode,
+};
+
+use super::*;
+use crate::aws::environments::EnvironmentInfo;
+use crate::aws::tofu_modules::{log_stream_prefix, owner_key};
+
+const ACCOUNT: &str = "111122223333";
+const REGION: &str = "eu-west-1";
+const USER: &str = "AROAEXAMPLEID:alice@example.com";
+const OTHER: &str = "AROAOTHERID:mallory";
+const PROJECT_ID: &str = "0f1e2d3c-4b5a-6978-8796-a5b4c3d2e1f0";
+const FAMILY: &str = "triple-c-dev-abcdef012345-0f1e2d3c-4b5";
+
+fn cluster() -> String {
+    format!("arn:aws:ecs:{REGION}:{ACCOUNT}:cluster/triple-c-dev")
+}
+
+fn td_arn(rev: u32) -> String {
+    format!("arn:aws:ecs:{REGION}:{ACCOUNT}:task-definition/{FAMILY}:{rev}")
+}
+
+fn task_arn(id: &str) -> String {
+    format!("arn:aws:ecs:{REGION}:{ACCOUNT}:task/triple-c-dev/{id}")
+}
+
+fn env_info() -> EnvironmentInfo {
+    EnvironmentInfo {
+        schema: 1,
+        name: "dev".into(),
+        template_version: 1,
+        cluster_arn: cluster(),
+        security_group_id: "sg-0123456789abcdef0".into(),
+        subnet_ids: vec!["subnet-0a".into(), "subnet-0b".into()],
+        assign_public_ip: true,
+        kms_key_arn: format!("arn:aws:kms:{REGION}:{ACCOUNT}:key/1234"),
+        log_group: "/triple-c/dev".into(),
+        network_mode: "public".into(),
+        tenancy: "strict".into(),
+    }
+}
+
+fn is_quota_error(e: &AwsError) -> bool {
+    matches!(e, AwsError::QuotaExceeded { .. })
+}
+
+fn info(id: &str, last: &str) -> TaskInfo {
+    TaskInfo {
+        arn: task_arn(id),
+        last_status: last.into(),
+        desired_status: if last == "STOPPED" {
+            "STOPPED"
+        } else {
+            "RUNNING"
+        }
+        .into(),
+        health: None,
+        stop_code: None,
+        stopped_reason: None,
+        task_definition_arn: td_arn(3),
+        runtime_id: None,
+        exec_agent_running: false,
+        exit_code: None,
+        owner: Some(USER.into()),
+        project: Some(PROJECT_ID.into()),
+    }
+}
+
+fn ready(id: &str) -> TaskInfo {
+    TaskInfo {
+        runtime_id: Some(format!("{id}-123")),
+        exec_agent_running: true,
+        ..info(id, "RUNNING")
+    }
+}
+
+/// A scripted `TaskApi`: `listed` answers ListTasks, `described` answers
+/// every DescribeTasks in turn (the last one repeats), `run` answers RunTask.
+#[derive(Default)]
+struct Fake {
+    listed: Vec<String>,
+    described: Mutex<Vec<Vec<TaskInfo>>>,
+    run: Mutex<Option<Result<TaskInfo, AwsError>>>,
+    logs: Vec<String>,
+    calls: Mutex<Vec<String>>,
+    run_requests: Mutex<Vec<RunTaskInput>>,
+    log_requests: Mutex<Vec<(String, String, i32)>>,
+}
+
+impl Fake {
+    fn calls(&self) -> Vec<String> {
+        self.calls.lock().unwrap().clone()
+    }
+    fn describing(self, answers: Vec<Vec<TaskInfo>>) -> Self {
+        *self.described.lock().unwrap() = answers;
+        self
+    }
+    fn running(self, r: Result<TaskInfo, AwsError>) -> Self {
+        *self.run.lock().unwrap() = Some(r);
+        self
+    }
+}
+
+impl TaskApi for Fake {
+    async fn run_task(&self, req: RunTaskInput) -> Result<TaskInfo, AwsError> {
+        self.calls.lock().unwrap().push("run".into());
+        self.run_requests.lock().unwrap().push(req);
+        self.run
+            .lock()
+            .unwrap()
+            .clone()
+            .unwrap_or_else(|| Ok(info("new", "PROVISIONING")))
+    }
+    async fn describe(&self, cluster: &str, arns: &[String]) -> Result<Vec<TaskInfo>, AwsError> {
+        self.calls
+            .lock()
+            .unwrap()
+            .push(format!("describe {cluster} {}", arns.join(",")));
+        let mut d = self.described.lock().unwrap();
+        let answer = if d.len() > 1 {
+            d.remove(0)
+        } else {
+            d.first().cloned().unwrap_or_default()
+        };
+        Ok(answer
+            .into_iter()
+            .filter(|t| arns.contains(&t.arn))
+            .collect())
+    }
+    async fn list_project_tasks(
+        &self,
+        cluster: &str,
+        family: &str,
+    ) -> Result<Vec<String>, AwsError> {
+        self.calls
+            .lock()
+            .unwrap()
+            .push(format!("list {cluster} {family}"));
+        Ok(self.listed.clone())
+    }
+    async fn stop_task(&self, _cluster: &str, arn: &str, reason: &str) -> Result<(), AwsError> {
+        self.calls
+            .lock()
+            .unwrap()
+            .push(format!("stop {arn} {reason}"));
+        Ok(())
+    }
+    async fn log_tail(
+        &self,
+        group: &str,
+        stream: &str,
+        limit: i32,
+    ) -> Result<Vec<String>, AwsError> {
+        self.log_requests
+            .lock()
+            .unwrap()
+            .push((group.into(), stream.into(), limit));
+        Ok(self.logs.clone())
+    }
+}
+
+fn tags() -> Vec<(String, String)> {
+    crate::aws::workspace::workspace_tags(USER, PROJECT_ID, "dev")
+}
+
+// ------------------------------------------------------------ run request
+
+#[test]
+fn on_demand_runs_fargate_on_the_environment_network_with_exec_and_the_three_tags() {
+    let req = run_task_request(&env_info(), &td_arn(3), false, &tags());
+    assert_eq!(req.cluster(), Some(cluster().as_str()));
+    assert_eq!(req.task_definition(), Some(td_arn(3).as_str()));
+    assert_eq!(req.launch_type(), Some(&LaunchType::Fargate));
+    assert!(req.capacity_provider_strategy().is_empty());
+    assert_eq!(req.enable_execute_command(), Some(true));
+    assert_eq!(req.count(), Some(1));
+    let vpc = req
+        .network_configuration()
+        .and_then(|n| n.awsvpc_configuration())
+        .expect("awsvpc");
+    assert_eq!(vpc.subnets(), ["subnet-0a", "subnet-0b"]);
+    assert_eq!(vpc.security_groups(), ["sg-0123456789abcdef0"]);
+    assert_eq!(vpc.assign_public_ip(), Some(&AssignPublicIp::Enabled));
+    let got: Vec<(String, String)> = req
+        .tags()
+        .iter()
+        .map(|t| (t.key().unwrap().to_string(), t.value().unwrap().to_string()))
+        .collect();
+    assert_eq!(got, tags());
+    // Nothing project-shaped rides along (P1), and tags are given, not propagated.
+    assert!(req.overrides().is_none());
+    assert!(req.propagate_tags().is_none());
+    assert!(req.enable_ecs_managed_tags().is_none());
+}
+
+#[test]
+fn spot_uses_the_fargate_spot_capacity_provider_and_no_launch_type() {
+    let req = run_task_request(&env_info(), &td_arn(3), true, &tags());
+    assert_eq!(req.launch_type(), None);
+    let strategy = req.capacity_provider_strategy();
+    assert_eq!(strategy.len(), 1);
+    assert_eq!(strategy[0].capacity_provider(), "FARGATE_SPOT");
+    assert_eq!(strategy[0].weight(), 1);
+}
+
+#[test]
+fn a_private_environment_gets_no_public_ip() {
+    let mut env = env_info();
+    env.assign_public_ip = false;
+    let req = run_task_request(&env, &td_arn(3), false, &tags());
+    let vpc = req
+        .network_configuration()
+        .unwrap()
+        .awsvpc_configuration()
+        .unwrap();
+    assert_eq!(vpc.assign_public_ip(), Some(&AssignPublicIp::Disabled));
+}
+
+// ------------------------------------------------------------ find or run
+
+#[tokio::test]
+async fn an_existing_running_task_is_reused_and_nothing_is_run() {
+    let api = Fake {
+        listed: vec![task_arn("t1")],
+        ..Default::default()
+    }
+    .describing(vec![vec![ready("t1")]]);
+    let got = find_or_run(&api, &env_info(), USER, PROJECT_ID, &td_arn(4), false)
+        .await
+        .unwrap();
+    assert!(got.reused);
+    assert_eq!(got.task.arn, task_arn("t1"));
+    assert!(!api.calls().contains(&"run".to_string()));
+    assert_eq!(api.calls()[0], format!("list {} {FAMILY}", cluster()));
+}
+
+#[tokio::test]
+async fn a_pending_task_is_reused_too() {
+    let api = Fake {
+        listed: vec![task_arn("t1")],
+        ..Default::default()
+    }
+    .describing(vec![vec![info("t1", "PENDING")]]);
+    let got = find_or_run(&api, &env_info(), USER, PROJECT_ID, &td_arn(3), false)
+        .await
+        .unwrap();
+    assert!(got.reused);
+    assert_eq!(got.task.last_status, "PENDING");
+    assert!(!api.calls().contains(&"run".to_string()));
+}
+
+#[tokio::test]
+async fn a_task_of_another_owner_or_project_in_the_family_is_never_reused() {
+    let mut foreign = info("theirs", "RUNNING");
+    foreign.owner = Some(OTHER.into());
+    let mut other_project = info("other-project", "RUNNING");
+    other_project.project = Some("ffffffff-0000-0000-0000-000000000000".into());
+    let mut untagged = info("untagged", "RUNNING");
+    untagged.owner = None;
+    untagged.project = None;
+    let api = Fake {
+        listed: vec![
+            task_arn("theirs"),
+            task_arn("other-project"),
+            task_arn("untagged"),
+        ],
+        ..Default::default()
+    }
+    .describing(vec![vec![foreign, other_project, untagged]]);
+    let got = find_or_run(&api, &env_info(), USER, PROJECT_ID, &td_arn(3), false)
+        .await
+        .unwrap();
+    assert!(!got.reused);
+    assert_eq!(got.task.arn, task_arn("new"));
+    assert_eq!(api.calls().last().unwrap(), "run");
+}
+
+#[tokio::test]
+async fn a_task_already_stopping_is_not_reused() {
+    let mut stopping = info("t1", "RUNNING");
+    stopping.desired_status = "STOPPED".into();
+    let api = Fake {
+        listed: vec![task_arn("t1"), task_arn("t2")],
+        ..Default::default()
+    }
+    .describing(vec![vec![stopping, info("t2", "DEPROVISIONING")]]);
+    let got = find_or_run(&api, &env_info(), USER, PROJECT_ID, &td_arn(3), false)
+        .await
+        .unwrap();
+    assert!(!got.reused);
+}
+
+#[tokio::test]
+async fn a_running_task_is_preferred_over_a_pending_one() {
+    let api = Fake {
+        listed: vec![task_arn("p"), task_arn("r")],
+        ..Default::default()
+    }
+    .describing(vec![vec![info("p", "PENDING"), ready("r")]]);
+    let got = find_project_task(&api, &cluster(), FAMILY, USER, PROJECT_ID)
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(got.arn, task_arn("r"));
+}
+
+#[tokio::test]
+async fn nothing_listed_means_no_describe_and_a_run_with_the_exact_revision_and_tags() {
+    let api = Fake::default();
+    let got = find_or_run(&api, &env_info(), USER, PROJECT_ID, &td_arn(7), true)
+        .await
+        .unwrap();
+    assert!(!got.reused);
+    assert_eq!(api.calls().len(), 2, "{:?}", api.calls());
+    let reqs = api.run_requests.lock().unwrap();
+    assert_eq!(reqs[0].task_definition(), Some(td_arn(7).as_str()));
+    assert_eq!(reqs[0].launch_type(), None);
+    let keys: Vec<&str> = reqs[0].tags().iter().filter_map(|t| t.key()).collect();
+    assert_eq!(
+        keys,
+        ["triple-c:environment", "triple-c:owner", "triple-c:project"]
+    );
+    assert_eq!(
+        reqs[0]
+            .tags()
+            .iter()
+            .find(|t| t.key() == Some("triple-c:owner"))
+            .unwrap()
+            .value(),
+        Some(USER)
+    );
+}
+
+#[tokio::test]
+async fn a_bare_family_or_foreign_arn_is_refused_before_any_call() {
+    let api = Fake::default();
+    for bad in [
+        FAMILY.to_string(),
+        format!("arn:aws:ecs:{REGION}:{ACCOUNT}:task-definition/{FAMILY}"),
+        format!("arn:aws:ecs:{REGION}:{ACCOUNT}:task-definition/{FAMILY}:latest"),
+        "arn:aws:ecs:eu-west-1:1:task-definition/someone-else:1".to_string(),
+    ] {
+        let err = find_or_run(&api, &env_info(), USER, PROJECT_ID, &bad, false)
+            .await
+            .unwrap_err();
+        assert!(matches!(err, AwsError::Other { .. }), "{bad}: {err:?}");
+    }
+    assert!(api.calls().is_empty());
+}
+
+#[tokio::test]
+async fn a_quota_refusal_is_reported_once_without_retrying() {
+    let api = Fake::default().running(Err(quota_error(
+        "You've reached the limit on the number of vCPUs you can run concurrently",
+    )));
+    let err = find_or_run(&api, &env_info(), USER, PROJECT_ID, &td_arn(3), false)
+        .await
+        .unwrap_err();
+    assert!(is_quota_error(&err));
+    let text = err.to_string();
+    assert!(text.contains("limit"), "{text}");
+    assert!(text.contains("quota"), "{text}");
+    assert!(text.contains("vCPUs"), "{text}");
+    assert_eq!(
+        api.calls().iter().filter(|c| *c == "run").count(),
+        1,
+        "no retry"
+    );
+}
+
+// ------------------------------------------------------------ quota mapping
+
+#[test]
+fn quota_texts_are_recognised_and_others_are_not() {
+    for q in [
+        "You've reached the limit on the number of vCPUs you can run concurrently",
+        "You\u{2019}ve reached the limit on the number of tasks you can run concurrently",
+        "LimitExceededException: too many",
+        "Service quota exceeded for Fargate On-Demand vCPU",
+        "limit exceeded",
+    ] {
+        assert!(looks_like_quota(q), "{q}");
+    }
+    for not in [
+        "Capacity is unavailable at this time. Please try again later",
+        "AccessDeniedException: not authorized",
+        "CannotPullContainerError",
+    ] {
+        assert!(!looks_like_quota(not), "{not}");
+    }
+}
+
+#[test]
+fn quota_mapping_turns_other_errors_into_quota_errors_and_leaves_the_rest() {
+    let q = quota_or(AwsError::Other {
+        message: "ClientException: You've reached the limit on the number of vCPUs".into(),
+    });
+    assert!(is_quota_error(&q));
+    // The frontend's `quota_exceeded` kind (lib/types.ts).
+    let v = serde_json::to_value(&q).unwrap();
+    assert_eq!(v["kind"], "quota_exceeded");
+    assert!(v["message"].as_str().unwrap().contains("vCPUs"));
+    let denied = AwsError::AccessDenied {
+        action: "ecs:RunTask".into(),
+        message: "limit".into(),
+    };
+    assert_eq!(quota_or(denied.clone()), denied);
+    assert!(!is_quota_error(&AwsError::Other {
+        message: "x".into()
+    }));
+}
+
+#[test]
+fn run_task_failures_become_errors_and_quota_failures_quota_errors() {
+    let ok = run_task_outcome(vec![info("a", "PROVISIONING")], vec![]).unwrap();
+    assert_eq!(ok.arn, task_arn("a"));
+    let err = run_task_outcome(
+        vec![],
+        vec![(Some("RESOURCE:ENI".into()), Some("no ENIs left".into()))],
+    )
+    .unwrap_err();
+    assert!(!is_quota_error(&err));
+    assert!(err.to_string().contains("RESOURCE:ENI"), "{err}");
+    assert!(err.to_string().contains("no ENIs left"), "{err}");
+    let err = run_task_outcome(
+        vec![],
+        vec![(
+            Some("You've reached the limit on the number of tasks you can run concurrently".into()),
+            None,
+        )],
+    )
+    .unwrap_err();
+    assert!(is_quota_error(&err));
+    let err = run_task_outcome(vec![], vec![]).unwrap_err();
+    assert!(err.to_string().contains("no task"), "{err}");
+}
+
+// ------------------------------------------------------------ wait
+
+fn timing() -> WaitTiming {
+    WaitTiming {
+        interval: Duration::from_secs(5),
+        timeout: Duration::from_secs(360),
+    }
+}
+
+fn logs() -> TaskLogs {
+    TaskLogs {
+        group: "/triple-c/dev".into(),
+        stream_prefix: log_stream_prefix(&owner_key(REGION, USER), PROJECT_ID),
+    }
+}
+
+#[tokio::test(start_paused = true)]
+async fn wait_polls_until_running_with_the_exec_agent_and_a_runtime_id() {
+    let mut half = info("t1", "RUNNING");
+    half.runtime_id = Some("rt".into());
+    let api = Fake::default().describing(vec![
+        vec![info("t1", "PROVISIONING")],
+        vec![info("t1", "PENDING")],
+        vec![half],
+        vec![ready("t1")],
+    ]);
+    let seen = Mutex::new(Vec::new());
+    let t0 = tokio::time::Instant::now();
+    let got = wait_ready(
+        &api,
+        &cluster(),
+        &task_arn("t1"),
+        &logs(),
+        timing(),
+        |t: &TaskInfo| seen.lock().unwrap().push(t.last_status.clone()),
+    )
+    .await
+    .unwrap();
+    assert_eq!(got, ready("t1"));
+    assert_eq!(
+        *seen.lock().unwrap(),
+        ["PROVISIONING", "PENDING", "RUNNING", "RUNNING"]
+    );
+    assert_eq!(t0.elapsed(), Duration::from_secs(15));
+}
+
+#[tokio::test(start_paused = true)]
+async fn a_task_that_stops_while_waiting_reports_its_reason_and_last_log_lines() {
+    let mut stopped = info("t1", "STOPPED");
+    stopped.stop_code = Some("EssentialContainerExited".into());
+    stopped.stopped_reason = Some("Essential container in task exited".into());
+    let api = Fake {
+        logs: vec!["Triple-C: starting".into(), "fatal: boom".into()],
+        ..Default::default()
+    }
+    .describing(vec![vec![info("t1", "PENDING")], vec![stopped]]);
+    let err = wait_ready(
+        &api,
+        &cluster(),
+        &task_arn("t1"),
+        &logs(),
+        timing(),
+        |_: &TaskInfo| {},
+    )
+    .await
+    .unwrap_err();
+    let text = err.to_string();
+    assert!(
+        text.contains("Essential container in task exited"),
+        "{text}"
+    );
+    assert!(text.contains("Triple-C: starting\nfatal: boom"), "{text}");
+    let reqs = api.log_requests.lock().unwrap();
+    assert_eq!(
+        *reqs,
+        [(
+            "/triple-c/dev".to_string(),
+            format!("{}/workspace/t1", logs().stream_prefix),
+            50
+        )]
+    );
+}
+
+#[tokio::test(start_paused = true)]
+async fn a_task_being_stopped_fails_the_wait_at_once() {
+    let mut stopping = info("t1", "RUNNING");
+    stopping.desired_status = "STOPPED".into();
+    stopping.stop_code = Some("SpotInterruption".into());
+    stopping.stopped_reason = Some("Your Spot Task was interrupted.".into());
+    let api = Fake::default().describing(vec![vec![stopping]]);
+    let err = wait_ready(
+        &api,
+        &cluster(),
+        &task_arn("t1"),
+        &logs(),
+        timing(),
+        |_: &TaskInfo| {},
+    )
+    .await
+    .unwrap_err();
+    assert!(
+        err.to_string().contains("Your Spot Task was interrupted."),
+        "{err}"
+    );
+}
+
+#[tokio::test(start_paused = true)]
+async fn a_task_that_never_gets_ready_times_out_with_its_last_status() {
+    let api = Fake::default().describing(vec![vec![info("t1", "PENDING")]]);
+    let t0 = tokio::time::Instant::now();
+    let err = wait_ready(
+        &api,
+        &cluster(),
+        &task_arn("t1"),
+        &logs(),
+        timing(),
+        |_: &TaskInfo| {},
+    )
+    .await
+    .unwrap_err();
+    assert!(t0.elapsed() >= Duration::from_secs(360));
+    assert!(t0.elapsed() < Duration::from_secs(366));
+    let text = err.to_string();
+    assert!(text.contains("6 minutes"), "{text}");
+    assert!(text.contains("PENDING"), "{text}");
+}
+
+#[tokio::test(start_paused = true)]
+async fn a_task_that_vanishes_is_an_error_not_a_hang() {
+    let api = Fake::default().describing(vec![vec![]]);
+    let err = wait_ready(
+        &api,
+        &cluster(),
+        &task_arn("t1"),
+        &logs(),
+        timing(),
+        |_: &TaskInfo| {},
+    )
+    .await
+    .unwrap_err();
+    assert!(err.to_string().contains("no longer"), "{err}");
+}
+
+#[test]
+fn the_default_wait_is_five_seconds_for_six_minutes() {
+    let t = WaitTiming::default();
+    assert_eq!(t.interval, Duration::from_secs(5));
+    assert_eq!(t.timeout, Duration::from_secs(360));
+}
+
+// ------------------------------------------------------------ stop / logs
+
+#[tokio::test]
+async fn stop_passes_the_reason() {
+    let api = Fake::default();
+    api.stop_task(&cluster(), &task_arn("t1"), STOP_REASON)
+        .await
+        .unwrap();
+    assert_eq!(
+        api.calls(),
+        [format!("stop {} Stopped from Triple-C", task_arn("t1"))]
+    );
+}
+
+#[test]
+fn the_log_stream_is_prefix_container_task_id() {
+    assert_eq!(
+        task_log_stream("abc/p", &task_arn("0123abcd")),
+        "abc/p/workspace/0123abcd"
+    );
+}
+
+#[tokio::test]
+async fn stopped_among_reports_stopped_and_vanished_tasks_only() {
+    let api = Fake::default().describing(vec![vec![
+        ready("up"),
+        info("down", "STOPPED"),
+        info("pending", "PENDING"),
+    ]]);
+    let arns = vec![
+        task_arn("up"),
+        task_arn("down"),
+        task_arn("pending"),
+        task_arn("gone"),
+    ];
+    let mut got = stopped_among(&api, &cluster(), &arns).await.unwrap();
+    got.sort_by(|a, b| a.0.cmp(&b.0));
+    assert_eq!(
+        got,
+        [
+            (task_arn("down"), StopKind::Exited(None)),
+            (task_arn("gone"), StopKind::Exited(None)),
+        ]
+    );
+}
+
+// ------------------------------------------------------------ classify
+
+#[test]
+fn classify_stop_follows_the_spec_table() {
+    let with = |code: Option<&str>, reason: Option<&str>| TaskInfo {
+        stop_code: code.map(String::from),
+        stopped_reason: reason.map(String::from),
+        ..info("t", "STOPPED")
+    };
+    assert_eq!(
+        classify_stop(&with(Some("EssentialContainerExited"), Some("Essential container in task exited"))),
+        StopKind::Exited(Some("Essential container in task exited".into()))
+    );
+    // The entrypoint's idle stop exits with its own status.
+    let idle = TaskInfo { exit_code: Some(IDLE_EXIT_CODE), ..with(Some("EssentialContainerExited"), None) };
+    assert_eq!(classify_stop(&idle), StopKind::Idle);
+    let crashed = TaskInfo { exit_code: Some(137), ..with(Some("EssentialContainerExited"), None) };
+    assert_eq!(classify_stop(&crashed), StopKind::Exited(None));
+    // Only with that stop code: a user stop of a task that exits 75 is a user stop.
+    let user = TaskInfo { exit_code: Some(IDLE_EXIT_CODE), ..with(Some("UserInitiated"), None) };
+    assert_eq!(classify_stop(&user), StopKind::UserInitiated);
+    assert_eq!(
+        classify_stop(&with(Some("SpotInterruption"), None)),
+        StopKind::Spot
+    );
+    assert_eq!(
+        classify_stop(&with(
+            Some("TaskFailedToStart"),
+            Some("CannotPullContainerError: nope")
+        )),
+        StopKind::FailedToStart("CannotPullContainerError: nope".into())
+    );
+    assert!(matches!(
+        classify_stop(&with(Some("TaskFailedToStart"), None)),
+        StopKind::FailedToStart(r) if !r.is_empty()
+    ));
+    assert_eq!(
+        classify_stop(&with(Some("UserInitiated"), Some("Stopped from Triple-C"))),
+        StopKind::UserInitiated
+    );
+    assert_eq!(
+        classify_stop(&with(Some("TerminationNotice"), None)),
+        StopKind::Exited(None)
+    );
+    assert_eq!(
+        classify_stop(&with(Some("ServiceSchedulerInitiated"), None)),
+        StopKind::Exited(None)
+    );
+    assert_eq!(classify_stop(&with(None, Some("  "))), StopKind::Exited(None));
+}
+
+// ------------------------------------------------------------ SDK mapping
+
+#[test]
+fn task_info_reads_the_workspace_container_and_its_exec_agent() {
+    let task = Task::builder()
+        .task_arn(task_arn("t1"))
+        .last_status("RUNNING")
+        .desired_status("RUNNING")
+        .health_status(aws_sdk_ecs::types::HealthStatus::Healthy)
+        .stop_code(TaskStopCode::SpotInterruption)
+        .stopped_reason("r")
+        .task_definition_arn(td_arn(3))
+        .containers(
+            Container::builder()
+                .name("sidecar")
+                .runtime_id("wrong")
+                .exit_code(1)
+                .build(),
+        )
+        .containers(
+            Container::builder()
+                .name("workspace")
+                .runtime_id("rt-1")
+                .exit_code(75)
+                .managed_agents(
+                    ManagedAgent::builder()
+                        .name(ManagedAgentName::ExecuteCommandAgent)
+                        .last_status("RUNNING")
+                        .build(),
+                )
+                .build(),
+        )
+        .tags(Tag::builder().key("triple-c:owner").value(USER).build())
+        .tags(
+            Tag::builder()
+                .key("triple-c:project")
+                .value(PROJECT_ID)
+                .build(),
+        )
+        .build();
+    let i = task_info(&task);
+    assert_eq!(i.arn, task_arn("t1"));
+    assert_eq!(i.health.as_deref(), Some("HEALTHY"));
+    assert_eq!(i.stop_code.as_deref(), Some("SpotInterruption"));
+    assert_eq!(i.runtime_id.as_deref(), Some("rt-1"));
+    assert!(i.exec_agent_running);
+    assert_eq!(i.exit_code, Some(75), "the workspace container's, not the sidecar's");
+    assert_eq!(i.owner.as_deref(), Some(USER));
+    assert_eq!(i.project.as_deref(), Some(PROJECT_ID));
+
+    let bare = task_info(&Task::builder().task_arn("x").last_status("PENDING").build());
+    assert!(!bare.exec_agent_running);
+    assert_eq!(bare.runtime_id, None);
+    assert_eq!(bare.exit_code, None);
+    assert_eq!(bare.owner, None);
+}

app/src-tauri/src/aws/tofu_modules.rs

@@ -0,0 +1,351 @@
+//! The OpenTofu modules Triple-C ships (`aws/terraform/*` at the repo root)
+//! and the names the modules and the app agree on.
+//!
+//! Every name a module or a phase-4 command uses — environment, parameter,
+//! owner key, per-user roles, state bucket and keys — is built here and
+//! nowhere else. The tests parse the shipped HCL and pin it to these
+//! constants: versions, default tags, the record's fields, no inbound access
+//! and no endpoint overrides.
+
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use sha2::{Digest, Sha256};
+
+use crate::models::host_connection::validate_supported_region;
+
+/// `locals.template_version` (and the `triple-c:template-version` default
+/// tag) of `aws/terraform/environment`.
+pub const ENVIRONMENT_MODULE_VERSION: u32 = 1;
+/// The same for the user-onboarding module.
+#[allow(dead_code)] // the onboarding module's version; checked against its HCL by a test
+pub const ONBOARD_MODULE_VERSION: u32 = 1;
+/// The permissions boundary every module-created role carries (no path).
+/// Equal to [`super::policies::PERMISSIONS_BOUNDARY_NAME`]; a test checks it.
+pub const BOUNDARY_POLICY_NAME: &str = "triple-c-permissions-boundary";
+
+#[derive(Clone, Copy, Debug, Serialize, Deserialize, PartialEq, Eq, Hash)]
+#[serde(rename_all = "snake_case")]
+pub enum ModuleKind {
+    Environment,
+    UserOnboard,
+    PermissionsBoundary,
+}
+
+macro_rules! module {
+    ($dir:literal: $($file:literal),+ $(,)?) => {
+        &[$(($file, include_str!(concat!("../../../../aws/terraform/", $dir, "/", $file)))),+]
+    };
+}
+
+const ENVIRONMENT_FILES: &[(&str, &str)] = module!("environment":
+    "versions.tf",
+    "variables.tf",
+    "main.tf",
+    "network.tf",
+    "outputs.tf",
+    ".terraform.lock.hcl",
+);
+
+const USER_ONBOARD_FILES: &[(&str, &str)] = module!("user-onboard":
+    "versions.tf",
+    "variables.tf",
+    "main.tf",
+    "iam.tf",
+    "efs.tf",
+    "outputs.tf",
+    ".terraform.lock.hcl",
+);
+
+const PERMISSIONS_BOUNDARY_FILES: &[(&str, &str)] = module!("permissions-boundary":
+    "versions.tf",
+    "variables.tf",
+    "main.tf",
+    "outputs.tf",
+    ".terraform.lock.hcl",
+);
+
+/// The module's files as (file name relative to the module directory,
+/// contents), lock file included, for writing into a work or bundle folder.
+pub fn module_files(kind: ModuleKind) -> &'static [(&'static str, &'static str)] {
+    match kind {
+        ModuleKind::Environment => ENVIRONMENT_FILES,
+        ModuleKind::UserOnboard => USER_ONBOARD_FILES,
+        ModuleKind::PermissionsBoundary => PERMISSIONS_BOUNDARY_FILES,
+    }
+}
+
+/// `^[a-z][a-z0-9-]{0,19}$`, not ending in `-`, with no `--` — the same rule
+/// as the module's `environment_name` validation.
+pub fn validate_environment_name(name: &str) -> Result<String, String> {
+    let b = name.as_bytes();
+    let ok = !b.is_empty()
+        && b.len() <= 20
+        && b[0].is_ascii_lowercase()
+        && b.iter()
+            .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || *c == b'-')
+        && !name.ends_with('-')
+        && !name.contains("--");
+    if ok {
+        Ok(name.to_string())
+    } else {
+        Err(format!(
+            "\"{}\" is not a valid environment name: use 1 to 20 lowercase letters, digits and \
+             single hyphens, starting with a letter and not ending in a hyphen",
+            name.escape_debug()
+        ))
+    }
+}
+
+/// An environment's ECS cluster name (the environment module's).
+pub fn environment_cluster_name(env: &str) -> String {
+    format!("triple-c-{env}")
+}
+
+/// An environment's CloudWatch log group (the environment module's).
+pub fn environment_log_group(env: &str) -> String {
+    format!("/triple-c/{env}")
+}
+
+/// The SSM parameter holding an environment's record.
+pub fn environment_parameter_name(env: &str) -> String {
+    format!("/triple-c/environments/{env}")
+}
+
+/// The first 12 hex characters of `sha256("<region>:<aws:userid>")`. A
+/// `UserId` holds a `:`, which IAM role names reject, so per-user names use
+/// this instead. The region is part of it because role names are
+/// account-global while environments are regional: the same user in the same
+/// environment name in two regions gets two sets of roles.
+pub fn owner_key(region: &str, user_id: &str) -> String {
+    Sha256::digest(format!("{region}:{user_id}").as_bytes())
+        .iter()
+        .take(6)
+        .map(|b| format!("{b:02x}"))
+        .collect()
+}
+
+/// A user's (task role, execution role) names. At most 47 characters.
+pub fn user_role_names(env: &str, owner_key: &str) -> (String, String) {
+    (
+        format!("triple-c-{env}-{owner_key}-task"),
+        format!("triple-c-{env}-{owner_key}-exec"),
+    )
+}
+
+/// Whether a project id is used in names as it is: 1 to 64 characters of
+/// `[A-Za-z0-9-]`. Every UUID (how the app makes ids) is.
+fn is_clean_project_id(id: &str) -> bool {
+    (1..=64).contains(&id.len()) && id.bytes().all(|c| c.is_ascii_alphanumeric() || c == b'-')
+}
+
+/// 16 hex characters of `sha256(id)`.
+fn project_id_hash(id: &str) -> String {
+    Sha256::digest(id.as_bytes())
+        .iter()
+        .take(8)
+        .map(|b| format!("{b:02x}"))
+        .collect()
+}
+
+/// A project id as a name component, safe in a secret name, an EFS path and
+/// a log stream. A clean id (see [`is_clean_project_id`]) is used as is.
+/// Anything else — only a hand-edited `projects.json` has one — becomes its
+/// first 40 characters with everything outside `[A-Za-z0-9-]` replaced by
+/// `-`, then `_` and a hash of the whole id. Clean ids never contain `_`, so
+/// the two forms can't collide, and ids that sanitise alike (`a/b`, `a:b`)
+/// still differ by the hash.
+fn project_component(project_id: &str) -> String {
+    if is_clean_project_id(project_id) {
+        return project_id.to_string();
+    }
+    let prefix: String = project_id
+        .chars()
+        .take(40)
+        .map(|c| {
+            if c.is_ascii_alphanumeric() || c == '-' {
+                c
+            } else {
+                '-'
+            }
+        })
+        .collect();
+    format!("{prefix}_{}", project_id_hash(project_id))
+}
+
+/// A project's ECS task definition family:
+/// `triple-c-<env>-<owner_key>-<first 12 of the project id>` (an id that
+/// isn't clean contributes `_` and 11 hex of its hash instead). At most 55
+/// characters of `[A-Za-z0-9_-]`. Other users can register revisions into
+/// any `triple-c-*` family, so a family is never trusted by name alone (see
+/// `aws::workspace`), and two of a user's projects could share 12 leading
+/// characters, so a family's tasks and revisions are told apart by their
+/// `triple-c:project` tag.
+pub fn task_family(env: &str, owner_key: &str, project_id: &str) -> String {
+    let id: String = if is_clean_project_id(project_id) {
+        project_id.chars().take(12).collect()
+    } else {
+        format!("_{}", &project_id_hash(project_id)[..11])
+    };
+    format!("triple-c-{env}-{owner_key}-{id}")
+}
+
+/// The project's Secrets Manager secret (P1): `triple-c/<env>/<owner_key>/<project id>`.
+pub fn project_secret_name(env: &str, owner_key: &str, project_id: &str) -> String {
+    format!(
+        "triple-c/{env}/{owner_key}/{}",
+        project_component(project_id)
+    )
+}
+
+/// The root of the project's EFS access point (P4), at most 90 characters.
+pub fn access_point_root(owner_key: &str, project_id: &str) -> String {
+    format!("/triple-c/{owner_key}/{}", project_component(project_id))
+}
+
+/// The container's `awslogs-stream-prefix`; ECS names the stream
+/// `<prefix>/workspace/<task id>`.
+pub fn log_stream_prefix(owner_key: &str, project_id: &str) -> String {
+    format!("{owner_key}/{}", project_component(project_id))
+}
+
+/// The awslogs stream of a task's `workspace` container:
+/// `<prefix>/<container>/<task-id>`, the task id being the last segment of
+/// its ARN.
+pub fn task_log_stream(stream_prefix: &str, task_arn: &str) -> String {
+    let task_id = task_arn.rsplit('/').next().unwrap_or(task_arn);
+    format!("{stream_prefix}/workspace/{task_id}")
+}
+
+/// The `creation_token` of the user's file system (the onboarding module's
+/// `local.name`).
+pub fn user_file_system_token(env: &str, owner_key: &str) -> String {
+    format!("triple-c-{env}-{owner_key}")
+}
+
+/// The per-account, per-region state bucket.
+pub fn state_bucket_name(account: &str, region: &str) -> String {
+    format!("triple-c-tfstate-{account}-{region}")
+}
+
+/// One deployment, i.e. one state object in the bucket (D9).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Deployment<'a> {
+    /// The environment module for this environment name.
+    Environment(&'a str),
+    /// A user's onboarding module in an environment.
+    User { env: &'a str, owner_key: &'a str },
+    /// The account's permissions-boundary module.
+    Boundary,
+}
+
+/// A deployment's state object in [`state_bucket_name`] (D9); the lock is the
+/// same key plus `.tflock`.
+pub fn state_key(d: Deployment) -> String {
+    match d {
+        Deployment::Environment(env) => format!("environments/{env}/terraform.tfstate"),
+        Deployment::User { env, owner_key } => {
+            format!("users/{env}/{owner_key}/terraform.tfstate")
+        }
+        Deployment::Boundary => "boundary/terraform.tfstate".to_string(),
+    }
+}
+
+/// How an environment's tasks reach the network (D4).
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(tag = "mode", rename_all = "kebab-case")]
+pub enum NetworkChoice {
+    /// A new VPC with two public subnets; tasks get a public IP. No NAT, $0.
+    Public,
+    /// A new VPC with private subnets behind one NAT gateway (~$33/month).
+    PrivateNat,
+    /// The user's own VPC and exactly two subnets.
+    Existing {
+        vpc_id: String,
+        subnet_ids: Vec<String>,
+        assign_public_ip: bool,
+    },
+}
+
+/// `vpc-` / `subnet-` followed by 8 or 17 lowercase hex characters.
+fn is_aws_id(id: &str, prefix: &str) -> bool {
+    id.strip_prefix(prefix).is_some_and(|hex| {
+        (hex.len() == 8 || hex.len() == 17)
+            && hex.bytes().all(|c| matches!(c, b'0'..=b'9' | b'a'..=b'f'))
+    })
+}
+
+/// The environment module's `terraform.tfvars.json`. Applies the same rules
+/// as the module's variable validations, so a bad value fails here first.
+pub fn environment_vars(
+    env: &str,
+    region: &str,
+    network: &NetworkChoice,
+) -> Result<serde_json::Value, String> {
+    let env = validate_environment_name(env)?;
+    let region = validate_supported_region(region)?;
+    let (mode, vpc_id, subnet_ids, assign_public_ip) = match network {
+        NetworkChoice::Public => ("public", String::new(), Vec::new(), false),
+        NetworkChoice::PrivateNat => ("private-nat", String::new(), Vec::new(), false),
+        NetworkChoice::Existing {
+            vpc_id,
+            subnet_ids,
+            assign_public_ip,
+        } => {
+            if !is_aws_id(vpc_id, "vpc-") {
+                return Err(format!("\"{}\" is not a VPC id", vpc_id.escape_debug()));
+            }
+            if subnet_ids.len() != 2 {
+                return Err(format!(
+                    "An existing network needs exactly 2 subnets (in different availability \
+                     zones), not {}",
+                    subnet_ids.len()
+                ));
+            }
+            if let Some(bad) = subnet_ids.iter().find(|s| !is_aws_id(s, "subnet-")) {
+                return Err(format!("\"{}\" is not a subnet id", bad.escape_debug()));
+            }
+            if subnet_ids[0] == subnet_ids[1] {
+                return Err("The two subnets must be different".into());
+            }
+            (
+                "existing",
+                vpc_id.clone(),
+                subnet_ids.clone(),
+                *assign_public_ip,
+            )
+        }
+    };
+    Ok(json!({
+        "environment_name": env,
+        "region": region,
+        "network_mode": mode,
+        "vpc_id": vpc_id,
+        "subnet_ids": subnet_ids,
+        "assign_public_ip": assign_public_ip,
+    }))
+}
+
+/// The onboarding module's `terraform.tfvars.json` for the user whose
+/// `aws:userid` is `owner_id`. Bedrock stays on the workspace user's own
+/// credentials unless a later setting opts the task role in.
+pub fn onboarding_vars(env: &str, region: &str, owner_id: &str) -> serde_json::Value {
+    json!({
+        "environment_name": env,
+        "region": region,
+        "owner_id": owner_id,
+        "owner_key": owner_key(region, owner_id),
+        "bedrock_on_task_role": false,
+    })
+}
+
+/// The boundary module's `terraform.tfvars.json`: the shipped boundary
+/// document itself, so the module holds no second copy.
+pub fn boundary_vars(region: &str) -> serde_json::Value {
+    json!({
+        "region": region,
+        "policy_json": super::policies::permissions_boundary_json(),
+    })
+}
+
+#[cfg(test)]
+mod tests;

app/src-tauri/src/browser_view/commands.rs

@@ -6,6 +6,7 @@ use tauri::{AppHandle, State};
 
 use crate::browser_view::install::{self, BrowserSetupOutcome};
 use crate::browser_view::{manager, page, popout, BrowserViewState, BrowserViewStatus};
+use crate::host::ContainerTarget;
 use crate::AppState;
 
 /// Turn the pane on or off for a project.
@@ -57,12 +58,12 @@ pub async fn set_browser_view_enabled(
         return Ok(manager().status(&project_id, false).await);
     }
 
-    let container_id = running_container(&state, &project_id, "opening the browser view").await?;
+    let container = running_container(&state, &project_id, "opening the browser view").await?;
 
     manager()
         .start(
             project_id,
-            container_id,
+            container,
             app_handle,
             state.projects_store.clone(),
         )
@@ -106,8 +107,8 @@ pub async fn check_browser_view_support(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<crate::browser_view::detect::PlaywrightDetection, String> {
-    let container_id = running_container(&state, &project_id, "checking for Playwright").await?;
-    crate::browser_view::detect::detect(&container_id).await
+    let container = running_container(&state, &project_id, "checking for Playwright").await?;
+    crate::browser_view::detect::detect(&container).await
 }
 
 /// Install `playwright` and `@playwright/cli` into the container.
@@ -125,8 +126,8 @@ pub async fn install_browser_view_support(
     app_handle: AppHandle,
     state: State<'_, AppState>,
 ) -> Result<BrowserSetupOutcome, String> {
-    let container_id = running_container(&state, &project_id, "installing Playwright").await?;
-    install::install_packages(&app_handle, &project_id, &container_id).await
+    let container = running_container(&state, &project_id, "installing Playwright").await?;
+    install::install_packages(&app_handle, &project_id, &container).await
 }
 
 /// Install a browser — `chromium` (Playwright's own build, for scripts that
@@ -143,8 +144,8 @@ pub async fn install_browser_view_browser(
     state: State<'_, AppState>,
 ) -> Result<BrowserSetupOutcome, String> {
     let target = install::BrowserTarget::parse(&browser)?;
-    let container_id = running_container(&state, &project_id, "installing a browser").await?;
-    install::install_browser(&app_handle, &project_id, &container_id, target).await
+    let container = running_container(&state, &project_id, "installing a browser").await?;
+    install::install_browser(&app_handle, &project_id, &container, target).await
 }
 
 /// Detach the view into a window of its own, or raise the one already open.
@@ -240,17 +241,17 @@ pub async fn open_page_in_container_browser(
     if !(trimmed.starts_with("http://") || trimmed.starts_with("https://")) {
         return Err("Only http:// and https:// URLs can be opened in the browser.".to_string());
     }
-    let container_id = running_container(&state, &project_id, "opening a page").await?;
+    let container = running_container(&state, &project_id, "opening a page").await?;
     crate::commands::project_commands::emit_progress(
         &app_handle,
         &project_id,
         "Checking the container for Playwright…",
     );
-    let detection = crate::browser_view::detect::detect(&container_id).await?;
+    let detection = crate::browser_view::detect::detect(&container).await?;
     let opened = page::open(
         &app_handle,
         &project_id,
-        &container_id,
+        &container,
         &detection,
         trimmed,
         page::Viewport::sane(width, height),
@@ -273,7 +274,7 @@ pub async fn open_page_in_container_browser(
         manager()
             .start(
                 project_id.clone(),
-                container_id,
+                container,
                 app_handle.clone(),
                 state.projects_store.clone(),
             )
@@ -309,8 +310,8 @@ pub async fn set_container_page_viewport(
     height: u32,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
-    let container_id = running_container(&state, &project_id, "resizing the page").await?;
-    page::set_viewport(&container_id, page::Viewport::sane(width, height)).await
+    let container = running_container(&state, &project_id, "resizing the page").await?;
+    page::set_viewport(&container, page::Viewport::sane(width, height)).await
 }
 
 /// State of the page this opened, if any. Never fails: "no page" is an answer.
@@ -319,10 +320,10 @@ pub async fn get_container_page_state(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<page::PageState, String> {
-    let Ok(container_id) = running_container(&state, &project_id, "reading the page").await else {
+    let Ok(container) = running_container(&state, &project_id, "reading the page").await else {
         return Ok(page::PageState::default());
     };
-    Ok(page::state(&container_id).await)
+    Ok(page::state(&container).await)
 }
 
 /// Close the page this opened, leaving the view itself running.
@@ -331,8 +332,8 @@ pub async fn close_container_page(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
-    let container_id = running_container(&state, &project_id, "closing the page").await?;
-    page::close(&container_id).await;
+    let container = running_container(&state, &project_id, "closing the page").await?;
+    page::close(&container).await;
     Ok(())
 }
 
@@ -356,8 +357,8 @@ pub async fn set_browser_view_match_window(
     let Some((width, height)) = popout::inner_size(&app_handle, &project_id) else {
         return Ok(());
     };
-    let container_id = running_container(&state, &project_id, "matching the window").await?;
-    page::set_viewport(&container_id, page::Viewport::sane(width, height)).await
+    let container = running_container(&state, &project_id, "matching the window").await?;
+    page::set_viewport(&container, page::Viewport::sane(width, height)).await
 }
 
 /// Whether match-window mode is on. Read on mount, like the rest of the
@@ -391,28 +392,25 @@ async fn running_container(
     state: &State<'_, AppState>,
     project_id: &str,
     action: &str,
-) -> Result<String, String> {
+) -> Result<ContainerTarget, String> {
     let project = state
         .projects_store
         .get(project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let Some(container_id) = project.container_id.clone() else {
+    let Some(container) = ContainerTarget::for_project(&project) else {
         return Err(format!(
             "This project has no container yet. Start it before {}.",
             action
         ));
     };
-    if !crate::docker::container::is_container_running(&container_id)
-        .await
-        .unwrap_or(false)
-    {
+    if !container.is_running().await.unwrap_or(false) {
         return Err(format!(
             "The container for “{}” isn't running. Start it before {}.",
             project.name, action
         ));
     }
-    Ok(container_id)
+    Ok(container)
 }
 
 #[cfg(test)]

app/src-tauri/src/browser_view/detect.rs

@@ -36,7 +36,7 @@
 
 use serde::{Deserialize, Serialize};
 
-use crate::docker::exec::exec_oneshot;
+use crate::host::ContainerTarget;
 
 /// Marks the JSON payload in the probe's stdout, so unrelated chatter on the
 /// same stream (npm notices, Node warnings) can't be mistaken for the result.
@@ -277,12 +277,14 @@ impl PlaywrightDetection {
 /// Playwright installed with `npm i -g`, or merely *run* once through
 /// `npx @playwright/mcp`, is found as readily as one in
 /// `/workspace/node_modules`.
-pub async fn detect(container_id: &str) -> Result<PlaywrightDetection, String> {
-    let output = exec_oneshot(
-        container_id,
-        vec!["node".to_string(), "-e".to_string(), PROBE.to_string()],
-    )
-    .await?;
+pub async fn detect(container: &ContainerTarget) -> Result<PlaywrightDetection, String> {
+    let output = container
+        .exec_oneshot(vec![
+            "node".to_string(),
+            "-e".to_string(),
+            PROBE.to_string(),
+        ])
+        .await?;
 
     parse_probe_output(&output)
 }

app/src-tauri/src/browser_view/install.rs

@@ -67,9 +67,7 @@ use serde::Serialize;
 use tauri::AppHandle;
 
 use crate::commands::project_commands::emit_progress;
-use crate::docker::exec::{
-    create_attached_exec_as, exec_oneshot_as, wait_for_exec_exit, AttachedExec,
-};
+use crate::host::{AttachedExec, ContainerTarget, ExecSpec};
 
 use super::detect::{self, PlaywrightDetection};
 
@@ -240,7 +238,7 @@ pub struct BrowserSetupOutcome {
 pub async fn install_packages(
     app: &AppHandle,
     project_id: &str,
-    container_id: &str,
+    container: &ContainerTarget,
 ) -> Result<BrowserSetupOutcome, String> {
     emit_progress(
         app,
@@ -248,7 +246,7 @@ pub async fn install_packages(
         &format!("Installing @playwright/cli into {}/node_modules…", INSTALL_DIR),
     );
 
-    let mut step = npm_install(app, project_id, container_id, &[VIEWER_PACKAGE]).await?;
+    let mut step = npm_install(app, project_id, container, &[VIEWER_PACKAGE]).await?;
     if step.exit_code != 0 {
         return Err(format!(
             "npm couldn't install the viewer package in this container (exit {}).\n\nnpm said:\n{}",
@@ -265,9 +263,9 @@ pub async fn install_packages(
     // see the note on `npm_install`. The pin can only be read after the first
     // install has written the manifest, which is why this stays two commands
     // rather than one.
-    let spec = pinned_playwright_spec(container_id).await;
+    let spec = pinned_playwright_spec(container).await;
     emit_progress(app, project_id, &format!("Installing {}…", spec));
-    let second = npm_install(app, project_id, container_id, &[VIEWER_PACKAGE, &spec]).await?;
+    let second = npm_install(app, project_id, container, &[VIEWER_PACKAGE, &spec]).await?;
     if second.exit_code != 0 {
         return Err(format!(
             "npm couldn't install {} in this container (exit {}).\n\nnpm said:\n{}",
@@ -279,7 +277,7 @@ pub async fn install_packages(
     step.log = merge_logs(step.log, second.log);
 
     emit_progress(app, project_id, "Re-checking what the container has…");
-    let detection = detect::detect(container_id).await?;
+    let detection = detect::detect(container).await?;
 
     // A probe that still finds something missing after a successful npm run is
     // the interesting case, so it is surfaced rather than swallowed. And a
@@ -331,7 +329,7 @@ pub async fn install_packages(
 async fn npm_install(
     app: &AppHandle,
     project_id: &str,
-    container_id: &str,
+    container: &ContainerTarget,
     specs: &[&str],
 ) -> Result<StepResult, String> {
     let mut cmd = vec![
@@ -348,7 +346,7 @@ async fn npm_install(
     run_step(
         app,
         project_id,
-        container_id,
+        container,
         "claude",
         INSTALL_DIR,
         cmd,
@@ -363,20 +361,20 @@ async fn npm_install(
 /// Read from the manifest npm just wrote rather than guessed, and falling back
 /// to `@latest` when it can't be read — an unreadable manifest is a reason to
 /// install something, not nothing.
-async fn pinned_playwright_spec(container_id: &str) -> String {
+async fn pinned_playwright_spec(container: &ContainerTarget) -> String {
     let script = format!(
         "try{{const d=require('{}/node_modules/@playwright/cli/package.json').dependencies||{{}};\
          process.stdout.write(d.playwright||'');}}catch(e){{}}",
         INSTALL_DIR
     );
-    let (out, _code) = exec_oneshot_as(
-        container_id,
-        "claude",
-        vec!["node".to_string(), "-e".to_string(), script],
-        Vec::new(),
-    )
-    .await
-    .unwrap_or_default();
+    let (out, _code) = container
+        .exec_oneshot_as(
+            "claude",
+            vec!["node".to_string(), "-e".to_string(), script],
+            Vec::new(),
+        )
+        .await
+        .unwrap_or_default();
 
     let version: &str = out.trim();
     // A version, not a range or a URL: anything else goes to the fallback
@@ -411,10 +409,10 @@ fn merge_logs(first: String, second: String) -> String {
 pub async fn install_browser(
     app: &AppHandle,
     project_id: &str,
-    container_id: &str,
+    container: &ContainerTarget,
     target: BrowserTarget,
 ) -> Result<BrowserSetupOutcome, String> {
-    let before = detect::detect(container_id).await?;
+    let before = detect::detect(container).await?;
     let Some(cli) = before.playwright_cli.clone() else {
         return Err(
             "Playwright isn't installed in this container yet, so there is nothing to install a \
@@ -458,7 +456,7 @@ pub async fn install_browser(
         project_id,
         "Step 1/3 — checking whether this container already has the browser system libraries…",
     );
-    let state = check_libraries(container_id, &cli, target).await;
+    let state = check_libraries(container, &cli, target).await;
     match &state {
         LibraryState::Present => {
             emit_progress(
@@ -482,7 +480,7 @@ pub async fn install_browser(
             let deps = run_step(
                 app,
                 project_id,
-                container_id,
+                container,
                 "root",
                 "/tmp",
                 vec![
@@ -530,7 +528,7 @@ pub async fn install_browser(
     let dl = run_step(
         app,
         project_id,
-        container_id,
+        container,
         user,
         workdir,
         vec![
@@ -559,7 +557,7 @@ pub async fn install_browser(
         project_id,
         &format!("Step 3/3 — checking that {} actually launches…", target.cli_name()),
     );
-    let verdict = verify_launch(container_id, &before, target).await;
+    let verdict = verify_launch(container, &before, target).await;
     push_section(&mut log, &verdict.detail);
     if !verdict.ok {
         warning = merge(
@@ -590,7 +588,7 @@ pub async fn install_browser(
     }
 
     emit_progress(app, project_id, "Re-checking what the container has…");
-    let detection = detect::detect(container_id).await?;
+    let detection = detect::detect(container).await?;
 
     Ok(BrowserSetupOutcome {
         detection,
@@ -642,9 +640,12 @@ impl LibraryState {
 /// dpkg's status file. A *missing* package on such an image is simply not in
 /// any index, so apt fails, Playwright reports the failure, and this returns
 /// [`LibraryState::Unknown`] — which installs, which is the right answer.
-async fn check_libraries(container_id: &str, cli: &str, target: BrowserTarget) -> LibraryState {
-    let run = exec_oneshot_as(
-        container_id,
+async fn check_libraries(
+    container: &ContainerTarget,
+    cli: &str,
+    target: BrowserTarget,
+) -> LibraryState {
+    let run = container.exec_oneshot_as(
         "root",
         vec![
             "node".to_string(),
@@ -708,7 +709,7 @@ struct LaunchVerdict {
 /// Launch the browser headless, load one page, and close it. Seconds, and it is
 /// the only thing that distinguishes "downloaded" from "usable".
 async fn verify_launch(
-    container_id: &str,
+    container: &ContainerTarget,
     detection: &PlaywrightDetection,
     target: BrowserTarget,
 ) -> LaunchVerdict {
@@ -724,8 +725,7 @@ async fn verify_launch(
     };
     let dir = manifest.trim_end_matches("package.json").trim_end_matches('/');
 
-    let run = exec_oneshot_as(
-        container_id,
+    let run = container.exec_oneshot_as(
         "claude",
         vec![
             "node".to_string(),
@@ -884,13 +884,13 @@ impl StepResult {
 /// Run one command in the container, streaming every line it prints to the pane
 /// as `container-progress` and keeping the tail for the result.
 ///
-/// Uses `create_attached_exec_as` — the single attached-exec path — rather than
+/// Uses [`ContainerTarget::attach`] — the single attached-exec path — rather than
 /// `exec_oneshot`, because these commands run for minutes and the point is that
 /// the user can watch them.
 async fn run_step(
     app: &AppHandle,
     project_id: &str,
-    container_id: &str,
+    container: &ContainerTarget,
     user: &str,
     workdir: &str,
     cmd: Vec<String>,
@@ -900,7 +900,14 @@ async fn run_step(
         exec_id,
         mut output,
         input,
-    } = create_attached_exec_as(container_id, cmd, false, user, workdir).await?;
+    } = container
+        .attach(
+            ExecSpec::new(cmd)
+                .tty(false)
+                .user(user)
+                .working_dir(Some(workdir)),
+        )
+        .await?;
 
     // Nothing is ever written to this exec. Closing stdin means anything that
     // would prompt sees EOF and gives up, instead of waiting for a person who
@@ -944,7 +951,7 @@ async fn run_step(
         )),
         Ok(Err(e)) => Err(e),
         Ok(Ok(())) => Ok(StepResult {
-            exit_code: wait_for_exec_exit(&exec_id).await.unwrap_or(0),
+            exit_code: container.wait_exec_exit(&exec_id).await.unwrap_or(0),
             log,
         }),
     }

app/src-tauri/src/browser_view/mod.rs

@@ -50,7 +50,7 @@
 //! | Trigger | Path |
 //! |---|---|
 //! | Turned off in the UI | `set_browser_view_enabled(false)` → persist `false`, then [`BrowserViewManager::stop`] |
-//! | Container stopped, by the UI or otherwise | supervisor's `is_container_running` check |
+//! | Container stopped, by the UI or otherwise | supervisor's `is_running` check |
 //! | Project deleted | supervisor's `store.get()` check |
 //! | Container rebuilt | old container stops → supervisor exits; the new one is not auto-started |
 //! | Viewer died in the container | supervisor's periodic HTTP liveness probe |
@@ -90,8 +90,7 @@ use tokio::sync::{watch, Mutex};
 use tokio::task::JoinHandle;
 
 use crate::auth_bridge::proc_net::{self, PortFamily};
-use crate::docker::container::is_container_running;
-use crate::docker::exec::exec_oneshot;
+use crate::host::ContainerTarget;
 use crate::storage::projects_store::ProjectsStore;
 
 use detect::PlaywrightDetection;
@@ -282,7 +281,7 @@ impl BrowserViewManager {
     pub async fn start(
         &self,
         project_id: String,
-        container_id: String,
+        container: ContainerTarget,
         app: AppHandle,
         store: Arc<ProjectsStore>,
     ) -> Result<BrowserViewStatus, String> {
@@ -300,7 +299,7 @@ impl BrowserViewManager {
             return Ok(self.status(&project_id, true).await);
         }
 
-        let detection = detect::detect(&container_id).await?;
+        let detection = detect::detect(&container).await?;
         if !detection.is_usable() {
             let blocker = detection.blocker().unwrap_or_else(|| {
                 "Playwright is present but incomplete in this container.".to_string()
@@ -320,15 +319,15 @@ impl BrowserViewManager {
         // Doing this before choosing a port also frees the one a previous
         // session was using, so sessions don't walk up the range. Best-effort:
         // a container with no dashboard makes this a no-op.
-        let _ = kill_dashboard(&container_id, &cli_entry).await;
+        let _ = kill_dashboard(&container, &cli_entry).await;
 
-        let (container_port, entry_path) = start_viewer(&container_id, &cli_entry).await?;
+        let (container_port, entry_path) = start_viewer(&container, &cli_entry).await?;
 
         let token = generate_token();
         // `--host 127.0.0.1` is ours to set, so the family is known and there is
         // no need to go back to /proc/net to work it out.
         let proxy = match BrowserViewProxy::bind(
-            container_id.clone(),
+            container.clone(),
             container_port,
             PortFamily::V4,
             token.clone(),
@@ -337,7 +336,7 @@ impl BrowserViewManager {
         {
             Ok(p) => p,
             Err(e) => {
-                let _ = kill_dashboard(&container_id, &cli_entry).await;
+                let _ = kill_dashboard(&container, &cli_entry).await;
                 return Err(e);
             }
         };
@@ -354,7 +353,7 @@ impl BrowserViewManager {
         let (cancel_tx, cancel_rx) = watch::channel(false);
         let supervisor = tokio::spawn(supervise(
             project_id.clone(),
-            container_id.clone(),
+            container,
             cli_entry,
             container_port,
             epoch,
@@ -427,7 +426,7 @@ impl BrowserViewManager {
 #[allow(clippy::too_many_arguments)]
 async fn supervise(
     project_id: String,
-    container_id: String,
+    container: ContainerTarget,
     cli_entry: String,
     container_port: u16,
     epoch: u64,
@@ -443,7 +442,7 @@ async fn supervise(
             log::info!("Browser view: project {} is gone — tearing down", project_id);
             break;
         }
-        if !is_container_running(&container_id).await.unwrap_or(false) {
+        if !container.is_running().await.unwrap_or(false) {
             log::info!(
                 "Browser view: container for project {} is no longer running — tearing down",
                 project_id
@@ -459,7 +458,7 @@ async fn supervise(
             // view never waits out an in-flight exec.
             let alive = tokio::select! {
                 _ = cancel.changed() => break,
-                res = probe_entry_path(&container_id, container_port) => res.is_ok(),
+                res = probe_entry_path(&container, container_port) => res.is_ok(),
             };
             if !alive {
                 log::warn!(
@@ -477,7 +476,7 @@ async fn supervise(
     }
 
     proxy.shutdown().await;
-    let _ = kill_dashboard(&container_id, &cli_entry).await;
+    let _ = kill_dashboard(&container, &cli_entry).await;
 
     // Deregister, unless a newer session has already taken this project's slot.
     let superseded = {
@@ -538,7 +537,11 @@ const VIEWER_LOG: &str = "/tmp/triple-c-browser-view.log";
 /// redirected to [`VIEWER_LOG`] (both so `exec_oneshot` can return immediately
 /// rather than waiting on an inherited stdout, and so a failure has a trail),
 /// and readiness is established by [`wait_until_ready`] instead.
-async fn launch_viewer(container_id: &str, cli_entry: &str, port: u16) -> Result<(), String> {
+async fn launch_viewer(
+    container: &ContainerTarget,
+    cli_entry: &str,
+    port: u16,
+) -> Result<(), String> {
     // `NO_UPDATE_NOTIFIER` stops the CLI phoning registry.npmjs.org on every
     // launch; the container may have no egress, and we don't want to wait out a
     // DNS timeout before the dashboard binds.
@@ -549,13 +552,11 @@ async fn launch_viewer(container_id: &str, cli_entry: &str, port: u16) -> Result
         port,
         VIEWER_LOG
     );
-    exec_oneshot(
-        container_id,
-        vec!["sh".to_string(), "-c".to_string(), script],
-    )
-    .await
-    .map(|_| ())
-    .map_err(|e| format!("Could not start the Playwright viewer: {}", e))
+    container
+        .exec_oneshot(vec!["sh".to_string(), "-c".to_string(), script])
+        .await
+        .map(|_| ())
+        .map_err(|e| format!("Could not start the Playwright viewer: {}", e))
 }
 
 /// The dashboard singleton is keyed on a hash of the working directory, so
@@ -567,17 +568,15 @@ async fn launch_viewer(container_id: &str, cli_entry: &str, port: u16) -> Result
 const WORKDIR_PREFIX: &str = "cd /workspace 2>/dev/null || true";
 
 /// Stop the dashboard daemon. Verified to free the port and stop answering.
-async fn kill_dashboard(container_id: &str, cli_entry: &str) -> Result<String, String> {
+async fn kill_dashboard(container: &ContainerTarget, cli_entry: &str) -> Result<String, String> {
     let script = format!(
         "{}; NO_UPDATE_NOTIFIER=1 node {} show --kill",
         WORKDIR_PREFIX,
         shell_quote(cli_entry)
     );
-    exec_oneshot(
-        container_id,
-        vec!["sh".to_string(), "-c".to_string(), script],
-    )
-    .await
+    container
+        .exec_oneshot(vec!["sh".to_string(), "-c".to_string(), script])
+        .await
 }
 
 /// Turn a failed start into something the user can act on.
@@ -604,13 +603,16 @@ fn explain_start_failure(err: &str, log: &str) -> String {
 }
 
 /// Tail of the viewer's own output, for a start that didn't come up.
-async fn read_viewer_log(container_id: &str) -> String {
-    exec_oneshot(
-        container_id,
-        vec!["tail".to_string(), "-n".to_string(), "40".to_string(), VIEWER_LOG.to_string()],
-    )
-    .await
-    .unwrap_or_default()
+async fn read_viewer_log(container: &ContainerTarget) -> String {
+    container
+        .exec_oneshot(vec![
+            "tail".to_string(),
+            "-n".to_string(),
+            "40".to_string(),
+            VIEWER_LOG.to_string(),
+        ])
+        .await
+        .unwrap_or_default()
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -645,14 +647,17 @@ const MAX_PORT_ATTEMPTS: usize = 3;
 /// this layer, and the pane would then front it. What contains that is
 /// downstream — the host proxy is loopback-only and token-gated, and the pane's
 /// iframe is sandboxed — not this function.
-async fn start_viewer(container_id: &str, cli_entry: &str) -> Result<(u16, String), String> {
+async fn start_viewer(
+    container: &ContainerTarget,
+    cli_entry: &str,
+) -> Result<(u16, String), String> {
     let mut tried: Vec<u16> = Vec::new();
     let mut last: Option<String> = None;
 
     for _ in 0..MAX_PORT_ATTEMPTS {
         // Re-read the listener snapshot each attempt: the port that was free a
         // moment ago is exactly the one we may have just lost.
-        let port = match pick_viewer_port(container_id, &tried).await {
+        let port = match pick_viewer_port(container, &tried).await {
             Ok(p) => p,
             Err(e) => {
                 // Report why the *attempts* failed, not just "nothing free":
@@ -666,21 +671,21 @@ async fn start_viewer(container_id: &str, cli_entry: &str) -> Result<(u16, Strin
         };
         tried.push(port);
 
-        launch_viewer(container_id, cli_entry, port).await?;
+        launch_viewer(container, cli_entry, port).await?;
 
         // Wait for it to actually answer, and learn the entry URL while we're
         // there — see `probe_entry_path` for why that matters. This, not the
         // launcher's stdout, is the readiness signal: verified that the
         // "Listening on …" line is printed only on the very first start.
-        match wait_until_ready(container_id, port).await {
+        match wait_until_ready(container, port).await {
             Ok(path) => return Ok((port, path)),
             Err(e) => {
-                let log = read_viewer_log(container_id).await;
+                let log = read_viewer_log(container).await;
                 // Always kill before retrying: the dashboard is a singleton, so
                 // a launcher that came up on some *other* port would otherwise
                 // make every further attempt a no-op that silently ignores the
                 // port we asked for.
-                let _ = kill_dashboard(container_id, cli_entry).await;
+                let _ = kill_dashboard(container, cli_entry).await;
                 last = Some(explain_start_failure(&e, &log));
             }
         }
@@ -691,10 +696,9 @@ async fn start_viewer(container_id: &str, cli_entry: &str) -> Result<(u16, Strin
 
 /// First port in [`VIEWER_PORTS`] that nothing in the container is listening on
 /// and that this start has not already tried.
-async fn pick_viewer_port(container_id: &str, tried: &[u16]) -> Result<u16, String> {
-    let text = exec_oneshot(
-        container_id,
-        vec![
+async fn pick_viewer_port(container: &ContainerTarget, tried: &[u16]) -> Result<u16, String> {
+    let text = container
+        .exec_oneshot(vec![
             // Absolute path, deliberately, for the same reason the auth bridge
             // uses one: `container/Dockerfile` puts a container-writable
             // directory first on `PATH`, so a bare `cat` is a name the container
@@ -704,10 +708,9 @@ async fn pick_viewer_port(container_id: &str, tried: &[u16]) -> Result<u16, Stri
             "/usr/bin/cat".to_string(),
             "/proc/net/tcp".to_string(),
             "/proc/net/tcp6".to_string(),
-        ],
-    )
-    .await
-    .unwrap_or_default();
+        ])
+        .await
+        .unwrap_or_default();
     let taken = proc_net::parse_loopback_listeners(&text);
     VIEWER_PORTS
         .clone()
@@ -722,10 +725,10 @@ async fn pick_viewer_port(container_id: &str, tried: &[u16]) -> Result<u16, Stri
 }
 
 /// Poll the viewer until it answers, and return the path the pane should load.
-async fn wait_until_ready(container_id: &str, port: u16) -> Result<String, String> {
+async fn wait_until_ready(container: &ContainerTarget, port: u16) -> Result<String, String> {
     let deadline = tokio::time::Instant::now() + READY_TIMEOUT;
     loop {
-        let last = match probe_entry_path(container_id, port).await {
+        let last = match probe_entry_path(container, port).await {
             Ok(path) => return Ok(path),
             Err(e) => e,
         };
@@ -751,7 +754,7 @@ const PROBE_MARKER: &str = "__TRIPLE_C_BV_PATH__";
 /// a redirect — which matters, because a redirect drops the `?token=` the proxy
 /// gate wants and would leave a fresh connection to be authorised with nothing.
 /// A `200` (no redirect) is fine too; then the entry point is just `/`.
-async fn probe_entry_path(container_id: &str, port: u16) -> Result<String, String> {
+async fn probe_entry_path(container: &ContainerTarget, port: u16) -> Result<String, String> {
     // The request is bounded on both sides. Verified: the dashboard answers a
     // bad WebSocket path by holding the socket open forever rather than
     // erroring, so "no reply" is a state this probe has to be able to leave —
@@ -766,10 +769,7 @@ async fn probe_entry_path(container_id: &str, port: u16) -> Result<String, Strin
     );
     let out = tokio::time::timeout(
         PROBE_TIMEOUT * 2,
-        exec_oneshot(
-            container_id,
-            vec!["node".to_string(), "-e".to_string(), script],
-        ),
+        container.exec_oneshot(vec!["node".to_string(), "-e".to_string(), script]),
     )
     .await
     .map_err(|_| "the viewer probe did not return".to_string())??;

app/src-tauri/src/browser_view/page.rs

@@ -37,7 +37,7 @@ use serde::{Deserialize, Serialize};
 use tauri::AppHandle;
 
 use crate::commands::project_commands::emit_progress;
-use crate::docker::exec::exec_oneshot_as;
+use crate::host::ContainerTarget;
 
 use super::detect::PlaywrightDetection;
 
@@ -91,7 +91,7 @@ pub struct PageState {
 pub async fn open(
     app: &AppHandle,
     project_id: &str,
-    container_id: &str,
+    container: &ContainerTarget,
     detection: &PlaywrightDetection,
     url: &str,
     viewport: Viewport,
@@ -115,17 +115,17 @@ pub async fn open(
     // Reuse a helper that is already up. Relaunching would throw away the
     // browser's cookies and storage — which for the auth case means signing in
     // again to reach the second page, having just signed in on the first.
-    if state(container_id).await.ready {
+    if state(container).await.ready {
         emit_progress(app, project_id, "Navigating the container's browser…");
-        set_viewport(container_id, viewport).await?;
-        navigate(container_id, url).await?;
-        if let Some(state) = wait_for_url(container_id, url).await {
+        set_viewport(container, viewport).await?;
+        navigate(container, url).await?;
+        if let Some(state) = wait_for_url(container, url).await {
             return Ok(state);
         }
         // It stopped answering; fall through and start a fresh one.
     }
 
-    close(container_id).await;
+    close(container).await;
     // Cold start: a browser launch plus a page load, which is the several
     // seconds the user would otherwise spend wondering whether the click
     // registered.
@@ -150,52 +150,52 @@ pub async fn open(
         shell_quote(&script),
         HELPER_LOG
     );
-    exec_oneshot_as(
-        container_id,
-        "claude",
-        vec!["sh".to_string(), "-c".to_string(), launcher],
-        Vec::new(),
-    )
-    .await
-    .map_err(|e| format!("Could not start the browser helper: {}", e))?;
+    container
+        .exec_oneshot_as(
+            "claude",
+            vec!["sh".to_string(), "-c".to_string(), launcher],
+            Vec::new(),
+        )
+        .await
+        .map_err(|e| format!("Could not start the browser helper: {}", e))?;
 
     emit_progress(app, project_id, "Waiting for the page to load…");
-    wait_until_ready(container_id).await
+    wait_until_ready(container).await
 }
 
 /// Resize the open page. Cheap enough to call from a window-resize handler.
-pub async fn set_viewport(container_id: &str, viewport: Viewport) -> Result<(), String> {
+pub async fn set_viewport(container: &ContainerTarget, viewport: Viewport) -> Result<(), String> {
     write_control(
-        container_id,
+        container,
         serde_json::json!({ "viewport": viewport }).to_string(),
     )
     .await
 }
 
 /// Navigate the open page without relaunching the browser.
-pub async fn navigate(container_id: &str, url: &str) -> Result<(), String> {
-    write_control(container_id, serde_json::json!({ "url": url }).to_string()).await
+pub async fn navigate(container: &ContainerTarget, url: &str) -> Result<(), String> {
+    write_control(container, serde_json::json!({ "url": url }).to_string()).await
 }
 
 /// Ask the helper to shut down. Best effort: a container that has none is the
 /// normal case, and the caller is usually about to start one anyway.
-pub async fn close(container_id: &str) {
-    let _ = write_control(container_id, serde_json::json!({ "close": true }).to_string()).await;
+pub async fn close(container: &ContainerTarget) {
+    let _ = write_control(container, serde_json::json!({ "close": true }).to_string()).await;
 }
 
 /// Current state, or a default when no helper has ever run here.
-pub async fn state(container_id: &str) -> PageState {
+pub async fn state(container: &ContainerTarget) -> PageState {
     let script = format!(
         "try{{process.stdout.write(require('fs').readFileSync('{}','utf8'));}}catch(e){{}}",
         STATE_PATH
     );
-    let Ok((out, _)) = exec_oneshot_as(
-        container_id,
-        "claude",
-        vec!["node".to_string(), "-e".to_string(), script],
-        Vec::new(),
-    )
-    .await
+    let Ok((out, _)) = container
+        .exec_oneshot_as(
+            "claude",
+            vec!["node".to_string(), "-e".to_string(), script],
+            Vec::new(),
+        )
+        .await
     else {
         return PageState::default();
     };
@@ -204,20 +204,20 @@ pub async fn state(container_id: &str) -> PageState {
 
 /// Write the control file through Node rather than a shell redirect, so a URL
 /// is never interpreted by `sh`.
-async fn write_control(container_id: &str, json: String) -> Result<(), String> {
+async fn write_control(container: &ContainerTarget, json: String) -> Result<(), String> {
     let script = format!(
         "require('fs').writeFileSync('{}',process.argv[1]);",
         CONTROL_PATH
     );
-    exec_oneshot_as(
-        container_id,
-        "claude",
-        vec!["node".to_string(), "-e".to_string(), script, json],
-        Vec::new(),
-    )
-    .await
-    .map(|_| ())
-    .map_err(|e| format!("Could not reach the browser helper: {}", e))
+    container
+        .exec_oneshot_as(
+            "claude",
+            vec!["node".to_string(), "-e".to_string(), script, json],
+            Vec::new(),
+        )
+        .await
+        .map(|_| ())
+        .map_err(|e| format!("Could not reach the browser helper: {}", e))
 }
 
 /// Wait for a *running* helper to report the URL we just asked it for.
@@ -225,10 +225,10 @@ async fn write_control(container_id: &str, json: String) -> Result<(), String> {
 /// Bounded much tighter than a cold start: the browser is already up, so this
 /// is one navigation. `None` means it stopped answering, and the caller starts
 /// a fresh helper rather than reporting a page that isn't there.
-async fn wait_for_url(container_id: &str, url: &str) -> Option<PageState> {
+async fn wait_for_url(container: &ContainerTarget, url: &str) -> Option<PageState> {
     let deadline = std::time::Instant::now() + REUSE_TIMEOUT;
     loop {
-        let state = state(container_id).await;
+        let state = state(container).await;
         if state.ready && state.url.as_deref() == Some(url) {
             return Some(state);
         }
@@ -240,10 +240,10 @@ async fn wait_for_url(container_id: &str, url: &str) -> Option<PageState> {
 }
 
 /// Poll the state file until the helper says the page is up, or says why not.
-async fn wait_until_ready(container_id: &str) -> Result<PageState, String> {
+async fn wait_until_ready(container: &ContainerTarget) -> Result<PageState, String> {
     let deadline = std::time::Instant::now() + READY_TIMEOUT;
     loop {
-        let state = state(container_id).await;
+        let state = state(container).await;
         if let Some(error) = state.error.clone() {
             return Err(error);
         }

app/src-tauri/src/browser_view/popout.rs

@@ -255,15 +255,15 @@ fn on_resized(app: &AppHandle, project_id: &str, width: u32, height: u32) {
         }
 
         let state = app.state::<crate::AppState>();
-        let Some(container_id) = state
+        let Some(container) = state
             .projects_store
             .get(&project_id)
-            .and_then(|p| p.container_id)
+            .and_then(|p| crate::host::ContainerTarget::for_project(&p))
         else {
             return;
         };
         if let Err(e) = super::page::set_viewport(
-            &container_id,
+            &container,
             super::page::Viewport::sane(width, height),
         )
         .await

app/src-tauri/src/browser_view/proxy.rs

@@ -62,6 +62,7 @@ use tokio::task::{JoinHandle, JoinSet};
 
 use crate::auth_bridge::proc_net::PortFamily;
 use crate::auth_bridge::tunnel::tunnel_connection_with_prelude;
+use crate::host::ContainerTarget;
 
 /// Host loopback ports the pane may be served on, and therefore the exact set of
 /// origins enumerated in the app's `frame-src`. Keep the two in sync: adding a
@@ -103,9 +104,9 @@ impl Drop for BrowserViewProxy {
 
 impl BrowserViewProxy {
     /// Take the first free port in [`PROXY_PORTS`] on the host loopback and
-    /// start gating connections into `container_id`'s `container_port`.
+    /// start gating connections into `container`'s `container_port`.
     pub async fn bind(
-        container_id: String,
+        container: ContainerTarget,
         container_port: u16,
         family: PortFamily,
         token: String,
@@ -121,7 +122,7 @@ impl BrowserViewProxy {
                 Ok(listener) => {
                     let task = tokio::spawn(accept_loop(
                         listener,
-                        container_id,
+                        container,
                         family.socat_target(container_port),
                         container_port,
                         token,
@@ -172,7 +173,7 @@ fn host_authorities(port: u16) -> Vec<String> {
 #[allow(clippy::too_many_arguments)]
 async fn accept_loop(
     listener: TcpListener,
-    container_id: String,
+    container: ContainerTarget,
     target: String,
     container_port: u16,
     token: String,
@@ -195,7 +196,7 @@ async fn accept_loop(
                 let _ = stream.set_nodelay(true);
                 conns.spawn(serve_connection(
                     stream,
-                    container_id.clone(),
+                    container.clone(),
                     target.clone(),
                     container_port,
                     token.clone(),
@@ -214,7 +215,7 @@ async fn accept_loop(
 #[allow(clippy::too_many_arguments)]
 async fn serve_connection(
     mut stream: TcpStream,
-    container_id: String,
+    container: ContainerTarget,
     target: String,
     container_port: u16,
     token: String,
@@ -249,7 +250,7 @@ async fn serve_connection(
 
     // Authorized: hand the socket to the same socat-over-Docker-exec tunnel the
     // auth bridge uses, replaying the head we had to buffer to make the call.
-    tunnel_connection_with_prelude(container_id, target, stream, container_port, head).await;
+    tunnel_connection_with_prelude(container, target, stream, container_port, head).await;
 }
 
 /// Read bytes until the end of the HTTP request head (`\r\n\r\n`), or fail.

app/src-tauri/src/commands/auth_bridge_commands.rs

@@ -5,6 +5,7 @@
 use tauri::{AppHandle, State};
 
 use crate::auth_bridge::AuthBridgeStatus;
+use crate::host::ContainerTarget;
 use crate::AppState;
 
 /// Turn the bridge on or off for a project and return the resulting status.
@@ -29,16 +30,13 @@ pub async fn set_auth_bridge_enabled(
             .projects_store
             .get(&project_id)
             .ok_or_else(|| format!("Project {} not found", project_id))?;
-        if let Some(container_id) = project.container_id {
-            if crate::docker::container::is_container_running(&container_id)
-                .await
-                .unwrap_or(false)
-            {
+        if let Some(container) = ContainerTarget::for_project(&project) {
+            if container.is_running().await.unwrap_or(false) {
                 state
                     .auth_bridge
                     .start(
                         project_id.clone(),
-                        container_id,
+                        container,
                         app_handle,
                         state.projects_store.clone(),
                     )

app/src-tauri/src/commands/auth_token_commands.rs

@@ -76,8 +76,7 @@ use tauri::{AppHandle, Emitter, State};
 use tokio::io::AsyncWriteExt;
 use tokio::sync::{mpsc, oneshot, Mutex};
 
-use crate::docker::container::is_container_running;
-use crate::docker::exec::{create_attached_exec, wait_for_exec_exit, AttachedExec};
+use crate::host::{AttachedExec, ContainerTarget};
 use crate::storage::secure;
 use crate::AppState;
 
@@ -867,7 +866,7 @@ async fn type_code_then_enter<W: tokio::io::AsyncWrite + Unpin>(
 async fn run_setup_token(
     app: &AppHandle,
     project_id: &str,
-    container_id: &str,
+    target: &ContainerTarget,
     mut input_rx: mpsc::UnboundedReceiver<Vec<u8>>,
     mut cancel_rx: oneshot::Receiver<()>,
 ) -> Result<String, String> {
@@ -877,16 +876,16 @@ async fn run_setup_token(
         exec_id,
         mut output,
         mut input,
-    } = create_attached_exec(
-        container_id,
-        vec![
-            "sh".to_string(),
-            "-c".to_string(),
-            SETUP_TOKEN_SCRIPT.to_string(),
-        ],
-        true,
-    )
-    .await?;
+    } = target
+        .attach_exec(
+            vec![
+                "sh".to_string(),
+                "-c".to_string(),
+                SETUP_TOKEN_SCRIPT.to_string(),
+            ],
+            true,
+        )
+        .await?;
 
     let mut stripper = AnsiStripper::default();
     let mut redactor = SecretRedactor::default();
@@ -1041,7 +1040,7 @@ async fn run_setup_token(
     // Falling through to the token parse is right either way — a run that
     // printed a token succeeded whatever Docker says about it — but it is worth
     // saying so rather than silently calling it a clean exit.
-    match wait_for_exec_exit(&exec_id).await {
+    match target.wait_exec_exit(&exec_id).await {
         Some(0) => {}
         Some(code) => {
             return Err(format!(
@@ -1091,13 +1090,13 @@ pub async fn acquire_claude_token(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project.container_id.clone().ok_or_else(|| {
+    let target = ContainerTarget::for_project(&project).ok_or_else(|| {
         format!(
             "Project '{}' has no container yet. Start it, then run authentication again.",
             project.name
         )
     })?;
-    if !is_container_running(&container_id).await.unwrap_or(false) {
+    if !target.is_running().await.unwrap_or(false) {
         return Err(format!(
             "The container for '{}' is not running. Start it, then run authentication again.",
             project.name
@@ -1133,8 +1132,7 @@ pub async fn acquire_claude_token(
         "Running `claude setup-token` — sign in at the URL below, then submit the code it gives you.",
     );
 
-    let result =
-        run_setup_token(&app_handle, &project_id, &container_id, input_rx, cancel_rx).await;
+    let result = run_setup_token(&app_handle, &project_id, &target, input_rx, cancel_rx).await;
 
     // Release the flow. Nothing else needs unwinding: this command changes no
     // persisted state until the token itself is stored, which is the point.

app/src-tauri/src/commands/aws_commands.rs

@@ -52,7 +52,8 @@ pub async fn run_sso_login(profile: &str) -> Result<(), String> {
     log::info!("Running host-side AWS SSO login for profile '{}'", profile);
 
     let status = tokio::process::Command::new("aws")
-        .args(["sso", "login", "--profile", profile])
+        // One argv element, so a name starting with `-` is never an option.
+        .args(["sso", "login", &format!("--profile={profile}")])
         .status()
         .await
         .map_err(|e| format!("Failed to run aws sso login: {}", e))?;

app/src-tauri/src/commands/docker_commands.rs

@@ -34,6 +34,11 @@ pub async fn get_container_info(
         .projects_store
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
+    // An AWS project has no Docker container (its own name could match a
+    // stale one from before it moved to AWS).
+    if project.is_aws() {
+        return Ok(None);
+    }
     docker::get_container_info(&project).await
 }
 

app/src-tauri/src/commands/environment_commands/tests.rs

@@ -0,0 +1,631 @@
+use std::fs;
+use std::time::Duration;
+
+use serde_json::json;
+
+use super::*;
+use crate::aws::tofu::Workdir;
+use crate::aws::environments::{
+    EnvironmentState, Knowable, LockInfo, OnboardingState,
+};
+use crate::aws::tofu_modules::{
+    environment_vars, module_files, onboarding_vars, owner_key, state_key, ModuleKind,
+};
+
+const ACCOUNT: &str = "123456789012";
+const REGION: &str = "eu-west-1";
+const USER_ID: &str = "AROAEXAMPLEID12345678:alice";
+
+fn info(name: &str, mode: &str, assign_public_ip: bool) -> EnvironmentInfo {
+    EnvironmentInfo {
+        schema: 1,
+        name: name.into(),
+        template_version: 1,
+        cluster_arn: format!("arn:aws:ecs:{REGION}:{ACCOUNT}:cluster/triple-c-{name}"),
+        security_group_id: "sg-0123456789abcdef0".into(),
+        subnet_ids: vec![
+            "subnet-0123456789abcdef0".into(),
+            "subnet-0fedcba9876543210".into(),
+        ],
+        assign_public_ip,
+        kms_key_arn: format!("arn:aws:kms:{REGION}:{ACCOUNT}:key/1234abcd-12ab"),
+        log_group: format!("/triple-c/{name}"),
+        network_mode: mode.into(),
+        tenancy: "strict".into(),
+    }
+}
+
+fn env(name: &str, state: EnvironmentState, actions: Vec<EnvironmentAction>) -> DetectedEnvironment {
+    DetectedEnvironment {
+        name: name.into(),
+        template_version: None,
+        state,
+        actions,
+        info: None,
+        onboarding: None,
+        onboarding_actions: Vec::new(),
+        onboarded_users: Some(0),
+    }
+}
+
+fn scan(boundary: Knowable, environments: Vec<DetectedEnvironment>) -> EnvironmentScan {
+    EnvironmentScan {
+        region: REGION.into(),
+        account: ACCOUNT.into(),
+        owner_id: USER_ID.into(),
+        owner_key: owner_key(REGION, USER_ID),
+        state_bucket: Knowable::Yes,
+        boundary,
+        environments,
+    }
+}
+
+fn lock(age_secs: u64, local_process: bool) -> LockInfo {
+    LockInfo {
+        who: "someone@host".into(),
+        created: String::new(),
+        operation: "OperationTypeApply".into(),
+        age_secs,
+        local_process,
+    }
+}
+
+#[test]
+fn only_our_state_keys_are_accepted() {
+    let ok = owner_key(REGION, USER_ID);
+    let good = [
+        (
+            "environments/dev/terraform.tfstate".to_string(),
+            DeploymentKey::Environment("dev".into()),
+        ),
+        (
+            format!("users/dev/{ok}/terraform.tfstate"),
+            DeploymentKey::User { env: "dev".into(), owner_key: ok.clone() },
+        ),
+        ("boundary/terraform.tfstate".to_string(), DeploymentKey::Boundary),
+    ];
+    for (key, want) in good {
+        let parsed = parse_state_key(&key).unwrap();
+        assert_eq!(parsed, want);
+        assert_eq!(state_key(parsed.deployment()), key, "round trip");
+    }
+    let bad = [
+        "",
+        "environments/dev/terraform.tfstate.tflock",
+        "environments/Dev/terraform.tfstate",
+        "environments/dev-/terraform.tfstate",
+        "environments/../terraform.tfstate",
+        "environments/dev/../../boundary/terraform.tfstate",
+        "/environments/dev/terraform.tfstate",
+        "environments//terraform.tfstate",
+        "environments/dev/x/terraform.tfstate",
+        "environments/dev/terraform.tfstate/",
+        "users/dev/terraform.tfstate",
+        "users/dev/ABCDEF012345/terraform.tfstate",
+        "users/dev/abcdef01234/terraform.tfstate",
+        "users/dev/abcdef0123456/terraform.tfstate",
+        "users/dev/abcdef01234g/terraform.tfstate",
+        "boundary/x/terraform.tfstate",
+        "boundary/terraform.tfstate ",
+        "something/else",
+        "environments\\dev\\terraform.tfstate",
+    ];
+    for key in bad {
+        assert!(parse_state_key(key).is_err(), "{key:?} must be refused");
+    }
+}
+
+#[test]
+fn deploy_refuses_an_existing_name_and_a_missing_boundary() {
+    use EnvironmentAction::*;
+    let existing = vec![
+        env("dev", EnvironmentState::Ready, vec![Join]),
+        env("half", EnvironmentState::Incomplete { lock: None }, vec![Repair, Destroy]),
+    ];
+    let s = scan(Knowable::Yes, existing.clone());
+    assert!(deploy_refusal(&s, "prod").is_ok());
+    let e = deploy_refusal(&s, "dev").unwrap_err();
+    assert!(e.contains("already exists"), "{e}");
+    assert!(deploy_refusal(&s, "half").is_err(), "state without a record is taken too");
+    assert!(deploy_refusal(&s, "Not Valid").is_err());
+
+    let no_boundary = scan(Knowable::No, existing.clone());
+    let e = deploy_refusal(&no_boundary, "prod").unwrap_err();
+    assert!(e.contains("permissions boundary"), "{e}");
+    // A caller who can't tell is let through (the apply itself would fail).
+    assert!(deploy_refusal(&scan(Knowable::Unknown, existing), "prod").is_ok());
+}
+
+#[test]
+fn update_reuses_the_recorded_network() {
+    assert_eq!(
+        network_from_record(&info("dev", "public", true), None).unwrap(),
+        NetworkChoice::Public
+    );
+    assert_eq!(
+        network_from_record(&info("dev", "private-nat", false), None).unwrap(),
+        NetworkChoice::PrivateNat
+    );
+    let existing = info("dev", "existing", false);
+    assert_eq!(
+        network_from_record(&existing, Some("vpc-0123456789abcdef0")).unwrap(),
+        NetworkChoice::Existing {
+            vpc_id: "vpc-0123456789abcdef0".into(),
+            subnet_ids: existing.subnet_ids.clone(),
+            assign_public_ip: false,
+        }
+    );
+    // The VPC isn't in the record: without it from the state, refuse rather
+    // than guess.
+    assert!(network_from_record(&existing, None).is_err());
+    assert!(network_from_record(&existing, Some("not-a-vpc")).is_err());
+    assert!(network_from_record(&info("dev", "carrier-pigeon", false), None).is_err());
+    // And it round-trips into the module's variables unchanged.
+    let vars = environment_vars(
+        "dev",
+        REGION,
+        &network_from_record(&existing, Some("vpc-0123456789abcdef0")).unwrap(),
+    )
+    .unwrap();
+    assert_eq!(vars["network_mode"], "existing");
+    assert_eq!(vars["subnet_ids"], json!(existing.subnet_ids));
+}
+
+#[test]
+fn the_vpc_is_read_from_the_state_outputs() {
+    let state = json!({
+        "version": 4,
+        "outputs": { "vpc_id": { "value": "vpc-0123456789abcdef0", "type": "string" } },
+    })
+    .to_string();
+    assert_eq!(
+        vpc_id_from_state(state.as_bytes()).as_deref(),
+        Some("vpc-0123456789abcdef0")
+    );
+    assert_eq!(vpc_id_from_state(b"{}"), None);
+    assert_eq!(vpc_id_from_state(b"not json"), None);
+    let hostile = json!({"outputs": {"vpc_id": {"value": "vpc-1\"; rm -rf /"}}}).to_string();
+    assert_eq!(vpc_id_from_state(hostile.as_bytes()), None);
+}
+
+#[test]
+fn bundles_contain_the_module_backend_vars_and_readme() {
+    let dir = tempfile::tempdir().unwrap();
+    let ok = owner_key(REGION, USER_ID);
+    let d = Deployment::User { env: "dev", owner_key: &ok };
+    let vars = onboarding_vars("dev", REGION, USER_ID);
+    let written = write_bundle(dir.path(), d, ACCOUNT, REGION, &vars).unwrap();
+
+    for (name, text) in module_files(ModuleKind::UserOnboard) {
+        assert_eq!(&fs::read_to_string(dir.path().join(name)).unwrap(), text);
+        assert!(written.contains(&name.to_string()));
+    }
+    let bucket = format!("triple-c-tfstate-{ACCOUNT}-{REGION}");
+    let key = state_key(d);
+    let backend = fs::read_to_string(dir.path().join("backend.hcl")).unwrap();
+    assert!(backend.contains(&format!("bucket = \"{bucket}\"")), "{backend}");
+    assert!(backend.contains(&format!("key = \"{key}\"")), "{backend}");
+    assert!(backend.contains("use_lockfile = true"), "{backend}");
+    let tfvars: Value =
+        serde_json::from_str(&fs::read_to_string(dir.path().join("terraform.tfvars.json")).unwrap())
+            .unwrap();
+    assert_eq!(tfvars, vars);
+
+    let readme = fs::read_to_string(dir.path().join("README.txt")).unwrap();
+    for needle in [
+        bucket.as_str(),
+        key.as_str(),
+        ACCOUNT,
+        REGION,
+        "tofu init -backend-config=backend.hcl",
+        "tofu apply",
+        "terraform providers lock",
+        "registry.opentofu.org",
+        "1.10",
+        "aws s3api create-bucket",
+    ] {
+        assert!(readme.contains(needle), "README lacks {needle:?}:\n{readme}");
+    }
+    // Outside us-east-1 the bucket needs a location constraint.
+    assert!(readme.contains(&format!("\"LocationConstraint\":\"{REGION}\"")), "{readme}");
+    // The admin policy allows s3:CreateBucket only with the component tag
+    // in the request, so the tag goes on the create itself; and the bucket
+    // is configured as the app configures it, TLS-only policy included.
+    let create = readme
+        .lines()
+        .find(|l| l.contains("aws s3api create-bucket"))
+        .unwrap();
+    assert!(
+        create.contains(r#""Tags":[{"Key":"triple-c:component","Value":"state"}]"#),
+        "{create}"
+    );
+    for needle in [
+        "put-bucket-versioning",
+        "put-bucket-encryption",
+        "put-public-access-block",
+        "put-bucket-policy",
+        "aws:SecureTransport",
+        "DenyInsecureTransport",
+    ] {
+        assert!(readme.contains(needle), "README lacks {needle:?}:\n{readme}");
+    }
+    assert!(!readme.contains("put-bucket-tagging"), "a later tag can't satisfy the create");
+
+    // Writing again over our own files is fine...
+    write_bundle(dir.path(), d, ACCOUNT, REGION, &vars).unwrap();
+    // ...but an unrelated file (or folder) means the wrong folder.
+    fs::write(dir.path().join("notes.txt"), "mine").unwrap();
+    let e = write_bundle(dir.path(), d, ACCOUNT, REGION, &vars).unwrap_err();
+    assert!(e.contains("notes.txt"), "{e}");
+    assert_eq!(fs::read_to_string(dir.path().join("notes.txt")).unwrap(), "mine");
+    fs::remove_file(dir.path().join("notes.txt")).unwrap();
+    fs::create_dir(dir.path().join(".terraform")).unwrap();
+    assert!(write_bundle(dir.path(), d, ACCOUNT, REGION, &vars).is_err());
+}
+
+#[test]
+fn a_us_east_1_bundle_creates_its_bucket_without_a_location_constraint() {
+    let dir = tempfile::tempdir().unwrap();
+    let vars = environment_vars("dev", "us-east-1", &NetworkChoice::Public).unwrap();
+    write_bundle(dir.path(), Deployment::Environment("dev"), ACCOUNT, "us-east-1", &vars).unwrap();
+    let readme = fs::read_to_string(dir.path().join("README.txt")).unwrap();
+    assert!(readme.contains("aws s3api create-bucket"), "{readme}");
+    assert!(!readme.contains("LocationConstraint"), "{readme}");
+    assert!(readme.contains(r#""Tags":[{"Key":"triple-c:component","Value":"state"}]"#), "{readme}");
+    assert!(readme.contains("tofu destroy"), "{readme}");
+    for (name, _) in module_files(ModuleKind::Environment) {
+        assert!(dir.path().join(name).is_file(), "{name}");
+    }
+}
+
+#[test]
+fn owner_ids_must_look_like_an_aws_user_id() {
+    for ok in ["AIDAEXAMPLEUSERID1234", "AROAEXAMPLEID12345678:alice", "AROA1234567890ABCDEF:a.b@c_d-e+f=g,h"] {
+        assert_eq!(validate_owner_id(ok).unwrap(), ok);
+    }
+    for bad in [
+        "",
+        "123456789012",
+        "aidaexampleuserid1234",
+        "AROAEXAMPLEID12345678:",
+        "AROAEXAMPLEID12345678:a b",
+        "AROAEXAMPLEID12345678:a:b",
+        "AROAEXAMPLEID12345678:\"",
+        &format!("AROAEXAMPLEID12345678:{}", "a".repeat(65)),
+        &"A".repeat(129),
+    ] {
+        assert!(validate_owner_id(bad).is_err(), "{bad:?}");
+    }
+}
+
+#[test]
+fn server_side_rechecks_follow_the_detected_actions() {
+    use EnvironmentAction::*;
+    let s = scan(
+        Knowable::Yes,
+        vec![
+            env("broken", EnvironmentState::Incomplete { lock: None }, vec![Repair, Destroy]),
+            env(
+                "working",
+                EnvironmentState::Incomplete { lock: Some(lock(9000, false)) },
+                vec![Repair, Unlock],
+            ),
+            env("ready", EnvironmentState::Ready, vec![Join]),
+            env("busy", EnvironmentState::Deploying { lock: Some(lock(10, true)) }, vec![Follow]),
+        ],
+    );
+    assert!(require_action(&s, "broken", Destroy).is_ok());
+    assert!(require_action(&s, "working", Destroy).is_err(), "never destroy a working env (D6)");
+    assert!(require_action(&s, "ready", Destroy).is_err());
+    assert!(require_action(&s, "missing", Destroy).is_err());
+    assert!(require_action(&s, "working", Repair).is_ok());
+    assert!(require_action(&s, "ready", Update).is_err());
+
+    assert!(unlock_refusal(&s, "working").is_ok());
+    assert!(unlock_refusal(&s, "broken").is_err(), "no lock to remove");
+    assert!(unlock_refusal(&s, "busy").is_err(), "a local runner holds it");
+    let local_stale = scan(
+        Knowable::Yes,
+        vec![env(
+            "x",
+            EnvironmentState::Incomplete { lock: Some(lock(9000, true)) },
+            vec![Unlock],
+        )],
+    );
+    assert!(unlock_refusal(&local_stale, "x").is_err());
+}
+
+#[test]
+fn onboarding_needs_a_joinable_environment_and_the_boundary() {
+    use EnvironmentAction::*;
+    let mut ready = env("dev", EnvironmentState::Ready, vec![Join]);
+    ready.onboarding = Some(OnboardingState::NotJoined);
+    let mut busy = env("busy", EnvironmentState::Ready, vec![Join]);
+    busy.onboarding = Some(OnboardingState::InProgress { lock: None });
+    let half = env("half", EnvironmentState::Incomplete { lock: None }, vec![Repair, Destroy]);
+    let s = scan(Knowable::Yes, vec![ready.clone(), busy, half]);
+    assert!(onboard_refusal(&s, "dev").is_ok());
+    assert!(onboard_refusal(&s, "busy").is_err());
+    assert!(onboard_refusal(&s, "half").is_err());
+    assert!(onboard_refusal(&s, "nope").is_err());
+    assert!(onboard_refusal(&scan(Knowable::No, vec![ready]), "dev").is_err());
+}
+
+#[test]
+fn progress_events_have_the_documented_shape() {
+    let p = DeployProgress {
+        op_id: "op".into(),
+        state_key: "boundary/terraform.tfstate".into(),
+        events: vec![],
+        done: false,
+        cancellable: true,
+        result: None,
+    };
+    let v = serde_json::to_value(&p).unwrap();
+    assert_eq!(
+        v,
+        json!({"op_id": "op", "state_key": "boundary/terraform.tfstate", "events": [], "done": false, "cancellable": true})
+    );
+    let done = DeployProgress {
+        done: true,
+        result: Some(TofuOutcome { ok: false, exit_code: 1, summary: Some("boom".into()) }),
+        ..p
+    };
+    let v = serde_json::to_value(&done).unwrap();
+    assert_eq!(v["result"], json!({"ok": false, "exit_code": 1, "summary": "boom"}));
+}
+
+#[test]
+fn an_already_running_start_names_the_deployment_and_suggests_follow() {
+    let e = start_error(StartError::AlreadyRunning, "environment \"dev\"");
+    let msg = e.to_string();
+    assert!(msg.contains("already running for environment \"dev\""), "{msg}");
+    assert!(msg.contains("Follow"), "{msg}");
+    let inner = AwsError::KeysMissing;
+    assert_eq!(start_error(StartError::Failed(inner.clone()), "x"), inner);
+}
+
+#[tokio::test]
+async fn a_follower_emits_nothing_until_its_gate_opens() {
+    use std::sync::{Arc, Mutex};
+    // A finished run: the whole replay and `done` are available at once,
+    // the case where events could otherwise beat the op id to the caller.
+    let dir = tempfile::tempdir().unwrap();
+    let lines: String = (0..450).map(|i| format!("line {i}\n")).collect();
+    fs::write(dir.path().join("apply.log"), lines).unwrap();
+    fs::write(dir.path().join("apply.exit"), "0\n").unwrap();
+    let wd = Workdir { dir: dir.path().to_path_buf() };
+    let base = DeployProgress {
+        op_id: "op-1".into(),
+        state_key: "boundary/terraform.tfstate".into(),
+        events: vec![],
+        done: false,
+        cancellable: true,
+        result: None,
+    };
+    let seen: Arc<Mutex<Vec<DeployProgress>>> = Arc::default();
+    let sink = seen.clone();
+    let (gate, rx) = Gate::new();
+    let task = tokio::spawn(follow_and_report(
+        rx,
+        wd,
+        base,
+        Duration::from_millis(10),
+        move |p| sink.lock().unwrap().push(p.clone()),
+    ));
+    tokio::time::sleep(Duration::from_millis(150)).await;
+    assert!(seen.lock().unwrap().is_empty(), "emitted before the gate opened");
+
+    gate.open();
+    task.await.unwrap();
+    let seen = seen.lock().unwrap();
+    let batches: Vec<usize> = seen.iter().filter(|p| !p.done).map(|p| p.events.len()).collect();
+    assert_eq!(batches, vec![200, 200, 50], "the whole log, in capped batches");
+    assert!(seen.iter().all(|p| p.op_id == "op-1" && p.state_key == "boundary/terraform.tfstate"));
+    let last = seen.last().unwrap();
+    assert!(last.done && !last.cancellable);
+    assert_eq!(last.result, Some(TofuOutcome { ok: true, exit_code: 0, summary: None }));
+    assert_eq!(seen.iter().filter(|p| p.done).count(), 1);
+}
+
+#[tokio::test]
+async fn a_dropped_gate_still_releases_the_follower() {
+    let dir = tempfile::tempdir().unwrap();
+    fs::write(dir.path().join("apply.log"), "x\n").unwrap();
+    fs::write(dir.path().join("apply.exit"), "1\n").unwrap();
+    let (gate, rx) = Gate::new();
+    drop(gate);
+    let mut n = 0;
+    follow_and_report(
+        rx,
+        Workdir { dir: dir.path().to_path_buf() },
+        DeployProgress {
+            op_id: "o".into(),
+            state_key: "k".into(),
+            events: vec![],
+            done: false,
+            cancellable: false,
+            result: None,
+        },
+        Duration::from_millis(10),
+        |_| n += 1,
+    )
+    .await;
+    assert_eq!(n, 2);
+}
+
+#[test]
+fn destroy_needs_the_action_no_record_and_no_lock() {
+    use EnvironmentAction::*;
+    let mut stale_with_record = env(
+        "rec",
+        EnvironmentState::Incomplete { lock: Some(lock(9000, false)) },
+        vec![Repair, Destroy, Unlock],
+    );
+    // Stale lock + record + no state: detection offers Destroy; the guard
+    // must still refuse (the record says it may be working).
+    stale_with_record.info = Some(info("rec", "public", true));
+    let mut record_unlocked = env("rec2", EnvironmentState::Incomplete { lock: None }, vec![Destroy]);
+    record_unlocked.info = Some(info("rec2", "public", true));
+    let s = scan(
+        Knowable::Yes,
+        vec![
+            stale_with_record,
+            record_unlocked,
+            env("locked", EnvironmentState::Incomplete { lock: Some(lock(9000, false)) }, vec![Repair, Destroy, Unlock]),
+            env("half", EnvironmentState::Incomplete { lock: None }, vec![Repair, Destroy]),
+            env("ready", EnvironmentState::Ready, vec![Join]),
+        ],
+    );
+    let e = destroy_refusal(&s, "rec").unwrap_err();
+    assert!(e.contains("valid record"), "{e}");
+    assert!(destroy_refusal(&s, "rec2").unwrap_err().contains("valid record"));
+    assert!(destroy_refusal(&s, "locked").unwrap_err().contains("Unlock it first"));
+    assert!(destroy_refusal(&s, "ready").is_err());
+    assert!(destroy_refusal(&s, "missing").is_err());
+    assert_eq!(destroy_refusal(&s, "half").unwrap().name, "half");
+}
+
+#[test]
+fn destroy_is_refused_while_users_are_onboarded() {
+    use EnvironmentAction::*;
+    let mut onboarded = env("half", EnvironmentState::Incomplete { lock: None }, vec![Repair, Destroy]);
+    onboarded.onboarded_users = Some(2);
+    let mut unknown = env("blind", EnvironmentState::Incomplete { lock: None }, vec![Repair, Destroy]);
+    unknown.onboarded_users = None;
+    let s = scan(Knowable::Yes, vec![onboarded, unknown]);
+    let e = destroy_refusal(&s, "half").unwrap_err();
+    assert!(e.contains("remove the onboarded users' stacks first"), "{e}");
+    assert!(e.contains("users/half/"), "{e}");
+    // Without a listing there's no telling, and nothing to destroy from.
+    assert!(destroy_refusal(&s, "blind").unwrap_err().contains("can't list"));
+}
+
+#[test]
+fn only_your_own_stale_onboarding_lock_can_be_removed() {
+    use EnvironmentAction::*;
+    let mut stale = env("dev", EnvironmentState::Ready, vec![Join]);
+    stale.onboarding = Some(OnboardingState::Incomplete { lock: Some(lock(9000, false)) });
+    stale.onboarding_actions = vec![Unlock];
+    let mut live = env("live", EnvironmentState::Ready, vec![Join]);
+    live.onboarding = Some(OnboardingState::InProgress { lock: Some(lock(10, false)) });
+    let mut none = env("none", EnvironmentState::Ready, vec![Join]);
+    none.onboarding = Some(OnboardingState::Incomplete { lock: None });
+    let s = scan(Knowable::Yes, vec![stale, live, none]);
+    let mine = owner_key(REGION, USER_ID);
+    assert!(onboarding_unlock_refusal(&s, "dev", &mine).is_ok());
+    let e = onboarding_unlock_refusal(&s, "dev", "0123456789ab").unwrap_err();
+    assert!(e.contains("your own"), "{e}");
+    assert!(onboarding_unlock_refusal(&s, "live", &mine).is_err());
+    assert!(onboarding_unlock_refusal(&s, "none", &mine).is_err());
+    assert!(onboarding_unlock_refusal(&s, "missing", &mine).is_err());
+}
+
+#[test]
+fn a_boundary_bundle_names_an_administrator_without_the_admin_files() {
+    let dir = tempfile::tempdir().unwrap();
+    write_bundle(dir.path(), Deployment::Boundary, ACCOUNT, REGION, &boundary_vars(REGION)).unwrap();
+    let readme = fs::read_to_string(dir.path().join("README.txt")).unwrap();
+    assert!(readme.contains("account administrator"), "{readme}");
+    assert!(readme.contains("WITHOUT"), "{readme}");
+    assert!(!readme.contains("that carry the Triple-C environment-admin"), "{readme}");
+}
+
+#[test]
+fn repair_and_update_are_refused_under_a_held_lock() {
+    use EnvironmentAction::*;
+    let s = scan(
+        Knowable::Yes,
+        vec![
+            env("locked", EnvironmentState::Incomplete { lock: Some(lock(9000, false)) }, vec![Repair, Unlock]),
+            env("free", EnvironmentState::Incomplete { lock: None }, vec![Repair]),
+            env("old", EnvironmentState::UpdateAvailable, vec![Join, Update]),
+        ],
+    );
+    let e = reapply_refusal(&s, "locked", Repair).unwrap_err();
+    assert!(e.contains("Unlock it first"), "{e}");
+    assert!(reapply_refusal(&s, "free", Repair).is_ok());
+    assert!(reapply_refusal(&s, "old", Update).is_ok());
+    assert!(reapply_refusal(&s, "free", Update).is_err());
+}
+
+#[test]
+fn unlock_deletes_only_a_still_stale_lock_and_reads_412_as_changed() {
+    assert!(stale_lock_refusal(0).is_err());
+    assert!(stale_lock_refusal(LIVE_LOCK_SECS - 1).is_err());
+    assert!(stale_lock_refusal(LIVE_LOCK_SECS).is_ok());
+    assert!(is_precondition_failed(Some("PreconditionFailed"), Some(412)));
+    assert!(is_precondition_failed(None, Some(412)));
+    assert!(!is_precondition_failed(Some("AccessDenied"), Some(403)));
+    assert!(!is_precondition_failed(None, Some(404)));
+}
+
+#[test]
+fn an_existing_boundary_without_state_here_is_refused() {
+    assert!(boundary_refusal(&Knowable::Yes, Some(false)).unwrap_err().contains("already exists"));
+    assert!(boundary_refusal(&Knowable::Yes, Some(true)).is_ok(), "re-apply our own");
+    assert!(boundary_refusal(&Knowable::Yes, None).is_ok(), "can't tell");
+    assert!(boundary_refusal(&Knowable::No, Some(false)).is_ok());
+    assert!(boundary_refusal(&Knowable::Unknown, Some(false)).is_ok());
+}
+
+#[test]
+fn a_follow_is_refused_while_a_launch_holds_the_folder() {
+    let dir = Path::new("/w/env/dev");
+    let mut slots: Slots<u32> = Slots::default();
+    slots.begin_launch(dir).unwrap();
+    let mut spawned = false;
+    let r = slots.install_follower(dir, "f1", false, || {
+        spawned = true;
+        1
+    });
+    assert_eq!(r.unwrap_err(), SlotBusy::Launching);
+    assert!(!spawned, "nothing is spawned for a refused follow");
+    // The launch's own follower replaces its Launching slot.
+    assert_eq!(slots.install_follower(dir, "l1", true, || 2).unwrap(), None);
+    slots.end_launch(dir); // the guard dropping afterwards
+    assert!(!slots.is_free(dir), "end_launch must not clear a follower");
+}
+
+#[test]
+fn a_launch_is_refused_while_a_follower_or_launch_holds_the_folder() {
+    let dir = Path::new("/w/env/dev");
+    let mut slots: Slots<u32> = Slots::default();
+    slots.install_follower(dir, "f1", false, || 1).unwrap();
+    assert_eq!(slots.begin_launch(dir).unwrap_err(), SlotBusy::Following);
+    slots.finish_follower(dir, "f1");
+    slots.begin_launch(dir).unwrap();
+    assert_eq!(slots.begin_launch(dir).unwrap_err(), SlotBusy::Launching);
+    slots.end_launch(dir);
+    assert!(slots.is_free(dir));
+    // Other folders are independent.
+    slots.begin_launch(dir).unwrap();
+    slots.begin_launch(Path::new("/w/env/prod")).unwrap();
+}
+
+#[test]
+fn a_finishing_follower_only_removes_its_own_slot() {
+    let dir = Path::new("/w/env/dev");
+    let mut slots: Slots<u32> = Slots::default();
+    slots.install_follower(dir, "old", false, || 1).unwrap();
+    // A re-follow replaces it and hands back the old task to abort.
+    assert_eq!(slots.install_follower(dir, "new", false, || 2).unwrap(), Some(1));
+    slots.finish_follower(dir, "old");
+    assert!(!slots.is_free(dir), "the old follower must not remove the new one's slot");
+    slots.finish_follower(dir, "new");
+    assert!(slots.is_free(dir));
+    // Nor a launch's slot.
+    slots.begin_launch(dir).unwrap();
+    slots.finish_follower(dir, "new");
+    assert_eq!(slots.begin_launch(dir).unwrap_err(), SlotBusy::Launching);
+}
+
+#[test]
+fn ending_a_launch_never_clears_a_following_slot() {
+    let dir = Path::new("/w/env/dev");
+    let mut slots: Slots<u32> = Slots::default();
+    slots.install_follower(dir, "f", false, || 1).unwrap();
+    slots.end_launch(dir);
+    assert_eq!(slots.begin_launch(dir).unwrap_err(), SlotBusy::Following);
+    slots.end_launch(Path::new("/w/env/none")); // nothing there: no-op
+}

app/src-tauri/src/commands/file_commands.rs

@@ -4,14 +4,11 @@ use std::sync::Arc;
 
 use base64::engine::general_purpose::STANDARD as BASE64;
 use base64::Engine as _;
-use bollard::container::{DownloadFromContainerOptions, LogOutput};
-use bollard::exec::{CreateExecOptions, StartExecResults};
 use futures_util::StreamExt;
 use serde::Serialize;
 use tauri::State;
 
-use crate::docker::client::get_docker;
-use crate::docker::exec::{exec_oneshot_as, exec_oneshot_streams_as, OUTPUT_LIMIT_MARKER};
+use crate::host::{ContainerTarget, ExecChunk, ExecSpec, OUTPUT_LIMIT_MARKER};
 use crate::AppState;
 
 #[derive(Debug, PartialEq, Serialize)]
@@ -63,9 +60,7 @@ pub async fn list_container_files(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "Container not running".to_string())?;
 
     // `exec_oneshot` discards the exit code, which is how a `find` that listed
@@ -78,7 +73,8 @@ pub async fn list_container_files(
     // are the error message, its `-printf` records are the listing, and the
     // parser should never be handed the former.
     let (records, diagnostics, code) =
-        exec_oneshot_streams_as(container_id, "claude", list_argv(&path), Vec::new())
+        target
+            .exec_oneshot_streams_as("claude", list_argv(&path), Vec::new())
             .await
             .map_err(|e| describe_listing_failure(&path, e))?;
 
@@ -156,7 +152,7 @@ fn list_argv(path: &str) -> Vec<String> {
 /// folder can act on.
 ///
 /// One case is worth naming: a directory with more entries than
-/// [`crate::docker::exec::MAX_ONESHOT_OUTPUT`] will hold. Roughly 100k names is
+/// [`crate::host::MAX_ONESHOT_OUTPUT`] will hold. Roughly 100k names is
 /// the point where a `find` record set passes 8 MiB, and what the panel showed
 /// was "Command output exceeded 8388608 bytes and was abandoned" — a true
 /// statement about a buffer, and no help at all about a directory.
@@ -430,7 +426,11 @@ pub(crate) fn validate_container_write_path(what: &str, path: &str) -> Result<()
 /// and the lexical answer stands: failing every write closed would break the
 /// panel outright for a risk the container user does not need this code path to
 /// take.
-async fn resolve_container_dir(container_id: &str, what: &str, dir: &str) -> Result<(), String> {
+async fn resolve_container_dir(
+    target: &ContainerTarget,
+    what: &str,
+    dir: &str,
+) -> Result<(), String> {
     validate_container_write_path(what, dir)?;
 
     // Split streams, not the combined buffer: `realpath`'s answer is a *path*
@@ -438,18 +438,18 @@ async fn resolve_container_dir(container_id: &str, what: &str, dir: &str) -> Res
     // hazard the listing above took apart for `find`. A warning on stderr —
     // and there is one whenever a component is unreadable — used to be spliced
     // into the string this then compared against the write roots.
-    let (stdout, diagnostics, code) = exec_oneshot_streams_as(
-        container_id,
-        "claude",
-        vec![
-            "realpath".to_string(),
-            "-m".to_string(),
-            "--".to_string(),
-            dir.to_string(),
-        ],
-        Vec::new(),
-    )
-    .await?;
+    let (stdout, diagnostics, code) = target
+        .exec_oneshot_streams_as(
+            "claude",
+            vec![
+                "realpath".to_string(),
+                "-m".to_string(),
+                "--".to_string(),
+                dir.to_string(),
+            ],
+            Vec::new(),
+        )
+        .await?;
 
     let resolved = stdout.trim();
     if code != 0 || resolved.is_empty() {
@@ -1188,7 +1188,7 @@ pub(crate) struct FetchedFile {
 
 /// Fetch a single regular file from a container as exact bytes.
 ///
-/// The viewer's read. It deliberately goes through Docker's archive endpoint rather than
+/// The viewer's read. It deliberately goes through the archive endpoint rather than
 /// `exec_oneshot`: that reader runs every chunk through `String::from_utf8_lossy`
 /// and merges stderr into stdout, so it would both corrupt any non-UTF-8 file
 /// and be able to splice diagnostics into what the caller believes is content.
@@ -1203,18 +1203,11 @@ pub(crate) struct FetchedFile {
 /// read — landed in host RAM twice. This function buffers, so every caller of
 /// it must name a ceiling.
 pub(crate) async fn fetch_container_file(
-    container_id: &str,
+    container: &ContainerTarget,
     container_path: &str,
     max_bytes: u64,
 ) -> Result<FetchedFile, String> {
-    let docker = get_docker()?;
-
-    let mut stream = docker.download_from_container(
-        container_id,
-        Some(DownloadFromContainerOptions {
-            path: container_path.to_string(),
-        }),
-    );
+    let mut stream = container.download_archive(container_path);
 
     // A tar member is a 512-byte header plus payload padded to 512. 8 KiB of
     // slack past the payload cap guarantees the header and the whole capped
@@ -1297,13 +1290,11 @@ pub async fn read_container_file(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "Container not running".to_string())?;
 
     let cap = max_bytes.unwrap_or(MAX_READ_BYTES).min(MAX_READ_BYTES);
-    let fetched = fetch_container_file(container_id, &path, cap).await?;
+    let fetched = fetch_container_file(&target, &path, cap).await?;
 
     Ok(FileContents {
         contents_base64: BASE64.encode(&fetched.bytes),
@@ -1333,9 +1324,7 @@ pub async fn rename_container_path(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "Container not running".to_string())?;
 
     // The name is checked by `validate_entry_name`; the path it is applied to
@@ -1349,7 +1338,7 @@ pub async fn rename_container_path(
     // directory component to resolve.
     let parent = parent_dir(&from_path);
     if parent != "/" {
-        resolve_container_dir(container_id, "Item", &parent).await?;
+        resolve_container_dir(&target, "Item", &parent).await?;
     }
 
     let new_name = to_path.trim();
@@ -1364,8 +1353,7 @@ pub async fn rename_container_path(
     // and exits 0 — so `-n` on its own would report a rename that never
     // happened. The existence check is what turns it into an error the user
     // sees; `-n` stays as the belt-and-braces against the race between them.
-    let (_, exists) = exec_oneshot_as(
-        container_id,
+    let (_, exists) = target.exec_oneshot_as(
         "claude",
         vec!["test".to_string(), "-e".to_string(), dest.clone()],
         Vec::new(),
@@ -1375,8 +1363,7 @@ pub async fn rename_container_path(
         return Err(format!("\"{}\" already exists in this folder", new_name));
     }
 
-    let (output, code) = exec_oneshot_as(
-        container_id,
+    let (output, code) = target.exec_oneshot_as(
         "claude",
         vec![
             "mv".to_string(),
@@ -1417,19 +1404,16 @@ pub async fn create_container_directory(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "Container not running".to_string())?;
 
-    resolve_container_dir(container_id, "Folder", &parent_path).await?;
+    resolve_container_dir(&target, "Folder", &parent_path).await?;
 
     let name = name.trim();
     validate_entry_name(name)?;
     let dest = join_path(&parent_path, name);
 
-    let (output, code) = exec_oneshot_as(
-        container_id,
+    let (output, code) = target.exec_oneshot_as(
         "claude",
         vec!["mkdir".to_string(), "--".to_string(), dest.clone()],
         Vec::new(),
@@ -1459,20 +1443,19 @@ pub(crate) fn not_running_message(action: &str, why: &str) -> String {
 /// Refuse, in a sentence, before a Docker error has to speak for us.
 ///
 /// Both file transfers and the backup run through `docker exec`, which needs a
-/// running container. Without this the failure surfaces as bollard's
+/// running container. Without this the failure surfaces as Docker's
 /// `is not running` wrapped in whatever the caller was doing, and for the
 /// upload it surfaces even less usefully: `resolve_container_dir`'s `realpath`
 /// is the first thing to touch the container, so a stopped project fails inside
 /// path *validation* and reads like the path was the problem.
-pub(crate) async fn require_running(container_id: &str, action: &str) -> Result<(), String> {
-    let docker = get_docker()?;
-    let running = docker
-        .inspect_container(container_id, None)
-        .await
-        .ok()
-        .and_then(|info| info.state)
-        .and_then(|s| s.running)
-        .unwrap_or(false);
+pub(crate) async fn require_running(
+    container: &ContainerTarget,
+    action: &str,
+) -> Result<(), String> {
+    // An unreachable daemon is an error; an inspect failure (container gone)
+    // reads as "not running" — `is_running`'s contract, and what this did
+    // when it inspected the container itself.
+    let running = container.is_running().await?;
     if running {
         return Ok(());
     }
@@ -1543,12 +1526,10 @@ pub async fn download_container_file(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "No container exists for this project yet — start it first".to_string())?;
 
-    require_running(container_id, "saving a file to the host").await?;
+    require_running(&target, "saving a file to the host").await?;
 
     let Some(chosen) = pick_save_path(&window, &suggested_save_name(&container_path)).await else {
         // Dismissed. Not an error, and deliberately distinguishable from one:
@@ -1564,8 +1545,6 @@ pub async fn download_container_file(
     // costs. See the note on `pick_save_path` about which ones those are.
     let dest = resolve_host_path(&chosen, HostPathUse::WriteChosenName).await?;
 
-    let docker = get_docker()?;
-
     // `$TC_SRC`, never argv interpolation: the path reaches the shell as an
     // environment value, so a name containing a quote or a `$` is data.
     //
@@ -1627,30 +1606,19 @@ esac
 echo "TC_SIZE=$SZ" >&2
 dd iflag=nonblock bs=64k status=none if="$TC_SRC" || exit 5"#;
 
-    let exec = docker
-        .create_exec(
-            container_id,
-            CreateExecOptions {
-                attach_stdout: Some(true),
-                attach_stderr: Some(true),
-                cmd: Some(vec!["sh".to_string(), "-c".to_string(), script.to_string()]),
-                env: Some(vec![format!("TC_SRC={}", container_path)]),
-                user: Some("claude".to_string()),
-                ..Default::default()
-            },
+    // As `claude`, no TTY, no stdin and no working directory (the image's
+    // default) — the options this exec has always been created with.
+    let exec = target
+        .attach(
+            ExecSpec::new(vec!["sh".to_string(), "-c".to_string(), script.to_string()])
+                .env(vec![format!("TC_SRC={}", container_path)])
+                .working_dir(None)
+                .no_stdin(),
         )
         .await
         .map_err(|e| format!("Failed to start download: {}", e))?;
-
-    let result = docker
-        .start_exec(&exec.id, None)
-        .await
-        .map_err(|e| format!("Failed to start download: {}", e))?;
-
-    let mut output = match result {
-        StartExecResults::Attached { output, .. } => output,
-        StartExecResults::Detached => return Err("Download exec started detached".to_string()),
-    };
+    let exec_id = exec.exec_id;
+    let mut output = exec.output;
 
     use tokio::io::AsyncWriteExt;
     let partial = partial_download_path(&dest)?;
@@ -1696,7 +1664,7 @@ dd iflag=nonblock bs=64k status=none if="$TC_SRC" || exit 5"#;
 
     while let Some(msg) = output.next().await {
         match msg {
-            Ok(LogOutput::StdOut { message }) => {
+            Ok(ExecChunk::StdOut(message)) => {
                 if let Err(e) = writer.write_all(&message).await {
                     stream_err = Some(format!("Failed to write {}: {}", dest.display(), e));
                     break;
@@ -1727,7 +1695,7 @@ dd iflag=nonblock bs=64k status=none if="$TC_SRC" || exit 5"#;
                     }
                 }
             }
-            Ok(LogOutput::StdErr { message }) => {
+            Ok(ExecChunk::StdErr(message)) => {
                 push_capped(&mut stderr_text, &message);
                 if declared.is_none() {
                     declared = parse_declared_size(&stderr_text);
@@ -1760,7 +1728,7 @@ dd iflag=nonblock bs=64k status=none if="$TC_SRC" || exit 5"#;
     // success renames a truncated partial over the file the user already had
     // and reports the byte count as if it were the whole thing. That is the one
     // way this command could destroy data, so silence is failure.
-    let exit_code = crate::docker::exec::wait_for_exec_exit(&exec.id).await;
+    let exit_code = target.wait_exec_exit(&exec_id).await;
     if stream_err.is_none() && exit_code != Some(0) {
         // Framed and clipped, never verbatim.
         //
@@ -1894,7 +1862,7 @@ pub struct UploadOutcome {
 ///   * the destination goes through [`resolve_container_dir`], so it is inside
 ///     [`CONTAINER_WRITE_ROOTS`] both as written and as it resolves;
 ///   * the read, the size ceiling and the descriptor check are
-///     `docker::exec::upload_host_file_with_ids`', unchanged — including
+///     `ContainerTarget::upload_host_file_with_ids`', unchanged — including
 ///     landing the file owned by the container user rather than root.
 ///
 /// The dialog itself is opened from Rust ([`pick_files_to_upload`]), which is
@@ -1911,15 +1879,13 @@ pub async fn upload_files_to_container(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "No container exists for this project yet — start it first".to_string())?;
 
     // Both checks before the dialog, so a project that cannot receive files
     // says so instead of asking the user to choose some first.
-    require_running(container_id, "uploading files").await?;
-    resolve_container_dir(container_id, "Upload", &container_dir).await?;
+    require_running(&target, "uploading files").await?;
+    resolve_container_dir(&target, "Upload", &container_dir).await?;
 
     let Some(picked) = pick_files_to_upload(&window).await else {
         return Ok(None);
@@ -1930,14 +1896,14 @@ pub async fn upload_files_to_container(
     // files; this one is the check that actually guards the extraction. A modal
     // has no time limit, and `resolve_container_dir` answers a question about
     // the container's filesystem — which the container is free to change while
-    // the dialog is open. Without this, `docker::exec`'s doc comment claim that
+    // the dialog is open. Without this, the uploader's doc comment claim that
     // the destination "has already been confirmed" would be true only of a
     // moment that had passed.
-    resolve_container_dir(container_id, "Upload", &container_dir).await?;
+    resolve_container_dir(&target, "Upload", &container_dir).await?;
 
     // Once for the whole selection, not once per file — see
     // `upload_host_file_with_ids`.
-    let ids = crate::docker::exec::container_user_ids(container_id).await;
+    let ids = target.user_ids().await;
 
     let mut outcome = UploadOutcome {
         uploaded: Vec::new(),
@@ -1951,7 +1917,7 @@ pub async fn upload_files_to_container(
                 continue;
             }
         };
-        match upload_one(container_id, &path, &container_dir, ids).await {
+        match upload_one(&target, &path, &container_dir, ids).await {
             Ok(dest) => {
                 log::info!("Uploaded {} into project {} at {}", path, project_id, dest);
                 outcome.uploaded.push(dest);
@@ -1966,7 +1932,7 @@ pub async fn upload_files_to_container(
 /// naming the file, because the caller may be reporting several at once and
 /// "is a folder" on its own does not say which one.
 async fn upload_one(
-    container_id: &str,
+    target: &ContainerTarget,
     host_path: &str,
     container_dir: &str,
     ids: (u64, u64),
@@ -1990,7 +1956,7 @@ async fn upload_one(
     // The ceiling is enforced against the open descriptor inside the uploader;
     // this copy of it exists so the refusal arrives as a sentence instead of
     // after a 300 MB read.
-    use crate::docker::exec::MAX_DROP_BYTES;
+    use crate::host::MAX_DROP_BYTES;
     if meta.len() > MAX_DROP_BYTES {
         return Err(format!(
             "{} is too large to upload ({:.0} MB; limit {} MB). Mount it into the project instead.",
@@ -2000,14 +1966,9 @@ async fn upload_one(
         ));
     }
 
-    crate::docker::exec::upload_host_file_with_ids(
-        container_id,
-        &resolved,
-        container_dir,
-        &name,
-        ids,
-    )
-    .await
+    target
+        .upload_host_file_with_ids(&resolved, container_dir, &name, ids)
+        .await
 }
 
 /// Container-authored diagnostic text, cut down to something safe to quote.
@@ -2274,14 +2235,10 @@ pub async fn download_container_backup(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "No container exists for this project yet — start it first".to_string())?;
 
-    let docker = get_docker()?;
-
-    require_running(container_id, "backing up").await?;
+    require_running(&target, "backing up").await?;
 
     let path = container_path.unwrap_or_else(|| "/workspace".to_string());
     // Read-only source: `tar -C` it, so absoluteness and `..` are what matter.
@@ -2326,33 +2283,22 @@ tar czf - --ignore-failed-read \
 
     let cmd = vec!["sh".to_string(), "-c".to_string(), script.to_string()];
 
-    let exec = docker
-        .create_exec(
-            container_id,
-            CreateExecOptions {
-                attach_stdout: Some(true),
-                attach_stderr: Some(true),
-                cmd: Some(cmd),
-                env: Some(vec![
+    // As `claude`, no TTY, no stdin and no working directory (the image's
+    // default) — the options this exec has always been created with.
+    let exec = target
+        .attach(
+            ExecSpec::new(cmd)
+                .env(vec![
                     "HOME=/home/claude".to_string(),
                     format!("TC_BACKUP_SRC={}", path),
-                ]),
-                user: Some("claude".to_string()),
-                ..Default::default()
-            },
+                ])
+                .working_dir(None)
+                .no_stdin(),
         )
         .await
-        .map_err(|e| format!("Failed to create backup exec: {}", e))?;
-
-    let result = docker
-        .start_exec(&exec.id, None)
-        .await
-        .map_err(|e| format!("Failed to start backup exec: {}", e))?;
-
-    let mut output = match result {
-        StartExecResults::Attached { output, .. } => output,
-        StartExecResults::Detached => return Err("Backup exec started detached".to_string()),
-    };
+        .map_err(|e| format!("Failed to start backup: {}", e))?;
+    let exec_id = exec.exec_id;
+    let mut output = exec.output;
 
     use tokio::io::AsyncWriteExt;
     let partial = partial_download_path(&dest)?;
@@ -2401,14 +2347,14 @@ tar czf - --ignore-failed-read \
 
     while let Some(msg) = output.next().await {
         match msg {
-            Ok(LogOutput::StdOut { message }) => {
+            Ok(ExecChunk::StdOut(message)) => {
                 if let Err(e) = writer.write_all(&message).await {
                     stream_err = Some(format!("Failed to write backup file: {}", e));
                     break;
                 }
                 total += message.len() as u64;
             }
-            Ok(LogOutput::StdErr { message }) => {
+            Ok(ExecChunk::StdErr(message)) => {
                 push_capped(&mut stderr_text, &message);
             }
             Ok(_) => {}
@@ -2430,7 +2376,7 @@ tar czf - --ignore-failed-read \
     // when `total > 0`. Poll until the exec actually reports finished so the
     // exit code is reliably populated; if it can't be determined we fall back to
     // the `total == 0` check below.
-    let exit_code = crate::docker::exec::wait_for_exec_exit(&exec.id).await;
+    let exit_code = target.wait_exec_exit(&exec_id).await;
 
     if stream_err.is_none() && exit_code.is_some_and(|c| c != 0) {
         stream_err = Some(format!(
@@ -3564,10 +3510,11 @@ mod tests {
 
         // `/workspace/escape` is under a write root as a string and is `/etc` as
         // a location.
-        let escaped = resolve_container_dir(&name, "Folder", "/workspace/escape").await;
+        let target = ContainerTarget::docker(name.clone());
+        let escaped = resolve_container_dir(&target, "Folder", "/workspace/escape").await;
         println!("container escape: {:?}", escaped);
         assert!(escaped.is_err(), "a symlink out of /workspace was accepted");
-        resolve_container_dir(&name, "Folder", "/workspace")
+        resolve_container_dir(&target, "Folder", "/workspace")
             .await
             .expect("/workspace itself");
 
@@ -3575,7 +3522,7 @@ mod tests {
         // reporting itself empty — `-H` follows the start point, and only the
         // start point.
         let (records, diagnostics, code) =
-            exec_oneshot_streams_as(&name, "claude", list_argv("/workspace/link"), Vec::new())
+            target.exec_oneshot_streams_as("claude", list_argv("/workspace/link"), Vec::new())
                 .await
                 .unwrap();
         println!("link: code={} diagnostics={:?}", code, diagnostics);
@@ -3588,7 +3535,7 @@ mod tests {
         // The link itself is still *marked* as one in its parent's listing, and
         // still navigable.
         let (records, _, _) =
-            exec_oneshot_streams_as(&name, "claude", list_argv("/workspace"), Vec::new())
+            target.exec_oneshot_streams_as("claude", list_argv("/workspace"), Vec::new())
                 .await
                 .unwrap();
         let parent = parse_find_output("/workspace", &records);
@@ -3607,7 +3554,7 @@ mod tests {
         for path in ["/workspace/broken", "/workspace/loop"] {
             let started = std::time::Instant::now();
             let (records, diagnostics, code) =
-                exec_oneshot_streams_as(&name, "claude", list_argv(path), Vec::new())
+                target.exec_oneshot_streams_as("claude", list_argv(path), Vec::new())
                     .await
                     .unwrap();
             let took = started.elapsed();

app/src-tauri/src/commands/file_viewer_commands.rs

@@ -18,6 +18,7 @@ use crate::file_viewer::registry::{
 use crate::file_viewer::resolve::{candidate_paths, fallback_candidate_paths, probe_candidates};
 use crate::file_viewer::window::open_viewer_window;
 use crate::file_viewer::write::{sha256_hex, write_file, SavedFile, MAX_WRITE_BYTES};
+use crate::host::ContainerTarget;
 use crate::models::Project;
 use crate::AppState;
 
@@ -113,13 +114,11 @@ fn project_of(state: &AppState, project_id: &str) -> Result<Project, String> {
 }
 
 /// `action` completes "Start the project before …", e.g. "saving this file".
-async fn running_container_of(project: &Project, action: &str) -> Result<String, String> {
-    let container_id = project
-        .container_id
-        .clone()
+async fn running_container_of(project: &Project, action: &str) -> Result<ContainerTarget, String> {
+    let container = ContainerTarget::for_project(project)
         .ok_or_else(|| not_running_message(action, "files live in its container"))?;
-    require_running(&container_id, action).await?;
-    Ok(container_id)
+    require_running(&container, action).await?;
+    Ok(container)
 }
 
 /// The container of the project a viewer window belongs to, if it is running.
@@ -127,7 +126,7 @@ async fn running_container_for(
     state: &AppState,
     target: &ViewerTarget,
     action: &str,
-) -> Result<String, String> {
+) -> Result<ContainerTarget, String> {
     running_container_of(&project_of(state, &target.project_id)?, action).await
 }
 
@@ -156,17 +155,17 @@ pub async fn open_file_viewer(
 ) -> Result<(), String> {
     require_main(window.label())?;
     let project = project_of(&state, &project_id)?;
-    let container_id = running_container_of(&project, "opening files").await?;
+    let container = running_container_of(&project, "opening files").await?;
 
     let mounts: Vec<String> = project.paths.iter().map(|p| p.mount_name.clone()).collect();
     let mut candidates = candidate_paths(&path, &mounts)?;
-    let mut matches = probe_candidates(&container_id, &candidates).await?;
+    let mut matches = probe_candidates(&container, &candidates).await?;
     // Not in the project: try home and /tmp, as a second exec so a project file
     // never becomes a chooser because a namesake sits in /tmp.
     if matches.is_empty() {
         let fallbacks = fallback_candidate_paths(&path);
         if !fallbacks.is_empty() {
-            matches = probe_candidates(&container_id, &fallbacks).await?;
+            matches = probe_candidates(&container, &fallbacks).await?;
             candidates.extend(fallbacks);
         }
     }
@@ -253,9 +252,9 @@ pub async fn viewer_read_file(
 ) -> Result<ViewerFile, String> {
     let (_label, target) = own_target(&window, &registry)?;
     let path = resolved_path(&target)?;
-    let container_id = running_container_for(&state, &target, "opening files").await?;
+    let container = running_container_for(&state, &target, "opening files").await?;
     let cap = max_bytes.clamp(1, MAX_READ_BYTES);
-    let fetched = fetch_container_file(&container_id, &path, cap).await?;
+    let fetched = fetch_container_file(&container, &path, cap).await?;
     let (editable, readonly_reason) = match validate_container_write_path("File", &path) {
         Ok(()) => (true, None),
         Err(reason) => (false, Some(reason)),
@@ -278,8 +277,8 @@ pub async fn viewer_poll_file(
 ) -> Result<ViewerPoll, String> {
     let (_label, target) = own_target(&window, &registry)?;
     let path = resolved_path(&target)?;
-    let container_id = running_container_for(&state, &target, "checking this file for changes").await?;
-    poll_file(&container_id, &path).await
+    let container = running_container_for(&state, &target, "checking this file for changes").await?;
+    poll_file(&container, &path).await
 }
 
 /// Errors from `write_file` pass through unchanged: the frontend matches the
@@ -302,8 +301,8 @@ pub async fn viewer_write_file(
     let bytes = BASE64
         .decode(contents_base64.as_bytes())
         .map_err(|_| "The editor sent malformed content.".to_string())?;
-    let container_id = running_container_for(&state, &target, "saving this file").await?;
-    write_file(&container_id, &state.exec_manager, &path, &bytes, &base_hash).await
+    let container = running_container_for(&state, &target, "saving this file").await?;
+    write_file(&container, &state.exec_manager, &path, &bytes, &base_hash).await
 }
 
 #[cfg(test)]

app/src-tauri/src/commands/host_commands.rs

@@ -0,0 +1,560 @@
+//! Commands for host connections (AWS): add, update, remove, identity,
+//! sign-in and the permission check.
+
+use std::future::Future;
+
+use tauri::State;
+
+use crate::aws::permissions::{check_permissions, PermissionReport, SdkPermissionApi};
+use crate::aws::policies::{policy_files, Tier};
+use crate::aws::{caller_identity, sdk_config, sdk_config_for_keys, AwsError, CallerIdentity};
+use crate::models::{
+    validate_connection_name, validate_profile_name, validate_supported_region, AppSettings, AwsAuth,
+    HostConnection, HostKind,
+};
+use crate::storage::secure::{self, AwsKeys};
+use crate::storage::settings_store::SettingsStore;
+use crate::AppState;
+
+fn other(message: impl Into<String>) -> AwsError {
+    AwsError::Other { message: message.into() }
+}
+
+fn check_id(id: &str) -> Result<(), String> {
+    if secure::is_valid_connection_id(id) {
+        Ok(())
+    } else {
+        Err("Invalid connection id".to_string())
+    }
+}
+
+/// What the identity check is asked to authenticate with.
+pub(crate) enum Credentials {
+    /// A named host profile (the connection itself).
+    Profile(HostConnection),
+    /// Keys not yet in the keychain, and the region to call in.
+    Keys(AwsKeys, String),
+}
+
+/// Validate-free core of both add commands: `GetCallerIdentity` first, and
+/// only on success keys are stored and the connection saved. An expired SSO
+/// session on a profile still saves (the UI then offers "Sign in").
+pub(crate) async fn add_connection_with<I, Fut>(
+    conn: HostConnection,
+    keys: Option<AwsKeys>,
+    identity: I,
+    store_keys: impl Fn(&str, &AwsKeys) -> Result<(), String>,
+    delete_keys: impl Fn(&str) -> Result<(), String>,
+    settings: &SettingsStore,
+) -> Result<HostConnection, AwsError>
+where
+    I: FnOnce(Credentials) -> Fut,
+    Fut: Future<Output = Result<CallerIdentity, AwsError>>,
+{
+    let HostKind::Aws { auth, default_region } = &conn.kind;
+    let credentials = match (&keys, auth) {
+        (Some(k), AwsAuth::Keys { .. }) => Credentials::Keys(k.clone(), default_region.clone()),
+        (None, AwsAuth::Profile { .. }) => Credentials::Profile(conn.clone()),
+        _ => return Err(other("Connection credentials do not match its auth method")),
+    };
+    match identity(credentials).await {
+        Ok(_) => {}
+        Err(AwsError::SsoExpired { .. }) if keys.is_none() => {}
+        Err(e) => return Err(e),
+    }
+
+    if let Some(k) = &keys {
+        store_keys(&conn.id, k).map_err(other)?;
+    }
+    if let Err(e) = settings.modify(|all| {
+        all.hosts.push(conn.clone());
+        Ok(())
+    }) {
+        if keys.is_some() {
+            let _ = delete_keys(&conn.id);
+        }
+        return Err(other(e));
+    }
+    Ok(conn)
+}
+
+/// Removes the stored connection with this id, however malformed its other
+/// fields are (a broken entry must stay removable). Its keychain entry is
+/// deleted only for a `Keys` connection whose `keyring_ref` is its own valid id.
+pub(crate) fn remove_connection_with(
+    id: &str,
+    delete_keys: impl Fn(&str) -> Result<(), String>,
+    settings: &SettingsStore,
+) -> Result<AppSettings, String> {
+    check_id(id)?;
+    let existing = settings
+        .get()
+        .hosts
+        .into_iter()
+        .find(|h| h.id == id)
+        .ok_or_else(|| "Connection not found".to_string())?;
+    let HostKind::Aws { auth, .. } = &existing.kind;
+    if let AwsAuth::Keys { keyring_ref } = auth {
+        if keyring_ref == id && secure::is_valid_connection_id(keyring_ref) {
+            delete_keys(keyring_ref)?;
+        }
+    }
+    settings
+        .modify(|s| {
+            s.hosts.retain(|h| h.id != id);
+            Ok(())
+        })
+        .map(|(saved, ())| saved)
+}
+
+async fn real_identity(c: Credentials) -> Result<CallerIdentity, AwsError> {
+    let cfg = match c {
+        Credentials::Profile(conn) => {
+            let HostKind::Aws { default_region, .. } = &conn.kind;
+            sdk_config(&conn, default_region).await?
+        }
+        Credentials::Keys(keys, region) => sdk_config_for_keys(&keys, &region),
+    };
+    caller_identity(&cfg).await
+}
+
+pub(crate) fn aws_conn(id: &str, settings: &AppSettings) -> Result<HostConnection, String> {
+    check_id(id)?;
+    let conn = settings
+        .hosts
+        .iter()
+        .find(|h| h.id == id)
+        .cloned()
+        .ok_or_else(|| "Connection not found".to_string())?;
+    // Defense in depth: stored values are re-checked before they reach the
+    // keychain, the SDK or a subprocess.
+    let HostKind::Aws { auth, default_region } = &conn.kind;
+    validate_supported_region(default_region)?;
+    match auth {
+        AwsAuth::Profile { name } => {
+            validate_profile_name(name)?;
+        }
+        AwsAuth::Keys { keyring_ref } if keyring_ref != id => {
+            return Err("Connection's keychain reference does not match its id".to_string());
+        }
+        AwsAuth::Keys { .. } => {}
+    }
+    Ok(conn)
+}
+
+fn validated(name: &str, region: &str) -> Result<(String, String), AwsError> {
+    Ok((
+        validate_connection_name(name).map_err(other)?,
+        validate_supported_region(region).map_err(other)?,
+    ))
+}
+
+#[tauri::command]
+pub async fn add_aws_profile_connection(
+    name: String,
+    profile: String,
+    default_region: String,
+    state: State<'_, AppState>,
+) -> Result<HostConnection, AwsError> {
+    let (name, default_region) = validated(&name, &default_region)?;
+    let profile = validate_profile_name(&profile).map_err(other)?;
+    let conn = HostConnection {
+        id: uuid::Uuid::new_v4().to_string(),
+        name,
+        kind: HostKind::Aws { auth: AwsAuth::Profile { name: profile }, default_region },
+    };
+    add_connection_with(
+        conn,
+        None,
+        real_identity,
+        secure::store_aws_keys,
+        secure::delete_aws_keys,
+        &state.settings_store,
+    )
+    .await
+}
+
+#[tauri::command]
+pub async fn add_aws_keys_connection(
+    name: String,
+    access_key_id: String,
+    secret_access_key: String,
+    session_token: Option<String>,
+    default_region: String,
+    state: State<'_, AppState>,
+) -> Result<HostConnection, AwsError> {
+    let (name, default_region) = validated(&name, &default_region)?;
+    let access_key_id = access_key_id.trim().to_string();
+    let secret_access_key = secret_access_key.trim().to_string();
+    let session_token = session_token.map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
+    if access_key_id.is_empty() || secret_access_key.is_empty() {
+        return Err(other("Access key ID and secret access key are required"));
+    }
+    let id = uuid::Uuid::new_v4().to_string();
+    let conn = HostConnection {
+        id: id.clone(),
+        name,
+        kind: HostKind::Aws { auth: AwsAuth::Keys { keyring_ref: id }, default_region },
+    };
+    let keys = AwsKeys { access_key_id, secret_access_key, session_token };
+    add_connection_with(
+        conn,
+        Some(keys),
+        real_identity,
+        secure::store_aws_keys,
+        secure::delete_aws_keys,
+        &state.settings_store,
+    )
+    .await
+}
+
+#[tauri::command]
+pub async fn update_aws_connection(
+    id: String,
+    name: String,
+    default_region: String,
+    state: State<'_, AppState>,
+) -> Result<HostConnection, AwsError> {
+    let (name, region) = validated(&name, &default_region)?;
+    let (_, updated) = state
+        .settings_store
+        .modify(|settings| {
+            aws_conn(&id, settings)?;
+            let conn = settings.hosts.iter_mut().find(|h| h.id == id).expect("checked above");
+            conn.name = name;
+            let HostKind::Aws { default_region, .. } = &mut conn.kind;
+            *default_region = region;
+            Ok(conn.clone())
+        })
+        .map_err(other)?;
+    Ok(updated)
+}
+
+#[tauri::command]
+pub async fn remove_host_connection(
+    id: String,
+    state: State<'_, AppState>,
+) -> Result<AppSettings, String> {
+    remove_connection_with(&id, secure::delete_aws_keys, &state.settings_store)
+}
+
+#[tauri::command]
+pub async fn aws_connection_identity(
+    id: String,
+    state: State<'_, AppState>,
+) -> Result<CallerIdentity, AwsError> {
+    let conn = aws_conn(&id, &state.settings_store.get()).map_err(other)?;
+    let HostKind::Aws { default_region, .. } = &conn.kind;
+    let cfg = sdk_config(&conn, default_region).await?;
+    caller_identity(&cfg).await
+}
+
+#[tauri::command]
+pub async fn aws_connection_sso_login(
+    id: String,
+    state: State<'_, AppState>,
+) -> Result<(), String> {
+    let conn = aws_conn(&id, &state.settings_store.get())?;
+    let HostKind::Aws { auth, .. } = &conn.kind;
+    let AwsAuth::Profile { name } = auth else {
+        return Err("Only profile connections use SSO".to_string());
+    };
+    let name = validate_profile_name(name)?;
+    super::aws_commands::run_sso_login(&name).await
+}
+
+#[tauri::command]
+pub async fn check_aws_permissions(
+    id: String,
+    region: Option<String>,
+    state: State<'_, AppState>,
+) -> Result<PermissionReport, AwsError> {
+    let conn = aws_conn(&id, &state.settings_store.get()).map_err(other)?;
+    let HostKind::Aws { default_region, .. } = &conn.kind;
+    let region = match region {
+        Some(r) => validate_supported_region(&r).map_err(other)?,
+        None => default_region.clone(),
+    };
+    let cfg = sdk_config(&conn, &region).await?;
+    let identity = caller_identity(&cfg).await?;
+    let api = SdkPermissionApi::new(&cfg);
+    check_permissions(&api, &identity, &region).await
+}
+
+/// One policy file of a tier: its file name under `aws/policies/` and its
+/// JSON, verbatim.
+#[derive(Debug, Clone, serde::Serialize, PartialEq, Eq)]
+pub struct PolicyFile {
+    pub name: String,
+    pub json: String,
+}
+
+/// Every policy file `tier` needs, in order; all of them are required (D7).
+#[tauri::command]
+pub fn aws_policy_document(tier: Tier) -> Vec<PolicyFile> {
+    policy_files(tier)
+        .iter()
+        .map(|(name, json)| PolicyFile {
+            name: name.to_string(),
+            json: json.to_string(),
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::cell::RefCell;
+
+    fn profile_conn() -> HostConnection {
+        HostConnection {
+            id: "c1".into(),
+            name: "Prod".into(),
+            kind: HostKind::Aws {
+                auth: AwsAuth::Profile { name: "dev".into() },
+                default_region: "us-west-2".into(),
+            },
+        }
+    }
+
+    fn keys_conn() -> HostConnection {
+        HostConnection {
+            id: "c2".into(),
+            name: "K".into(),
+            kind: HostKind::Aws {
+                auth: AwsAuth::Keys { keyring_ref: "c2".into() },
+                default_region: "us-west-2".into(),
+            },
+        }
+    }
+
+    fn keys() -> AwsKeys {
+        AwsKeys { access_key_id: "AKIA".into(), secret_access_key: "s".into(), session_token: None }
+    }
+
+    fn ident() -> CallerIdentity {
+        CallerIdentity { account: "1".into(), arn: "arn:aws:iam::1:user/u".into(), user_id: "U".into() }
+    }
+
+    fn store_in(dir: &tempfile::TempDir) -> SettingsStore {
+        SettingsStore::at_path(dir.path().join("settings.json"))
+    }
+
+    #[tokio::test]
+    async fn adding_saves_nothing_when_identity_fails() {
+        let dir = tempfile::tempdir().unwrap();
+        let settings = store_in(&dir);
+        let calls = RefCell::new(Vec::<String>::new());
+        let err = add_connection_with(
+            keys_conn(),
+            Some(keys()),
+            |_| async { Err(AwsError::InvalidCredentials { message: "bad".into() }) },
+            |id, _| { calls.borrow_mut().push(format!("store {id}")); Ok(()) },
+            |id| { calls.borrow_mut().push(format!("delete {id}")); Ok(()) },
+            &settings,
+        )
+        .await
+        .unwrap_err();
+        assert!(matches!(err, AwsError::InvalidCredentials { .. }));
+        assert!(settings.get().hosts.is_empty());
+        assert!(!dir.path().join("settings.json").exists());
+        assert!(calls.borrow().is_empty(), "{:?}", calls.borrow());
+    }
+
+    #[tokio::test]
+    async fn an_sso_expired_profile_is_still_saved() {
+        let dir = tempfile::tempdir().unwrap();
+        let settings = store_in(&dir);
+        let saved = add_connection_with(
+            profile_conn(),
+            None,
+            |_| async { Err(AwsError::SsoExpired { profile: "dev".into() }) },
+            |_, _| Ok(()),
+            |_| Ok(()),
+            &settings,
+        )
+        .await
+        .unwrap();
+        assert_eq!(settings.get().hosts, vec![saved]);
+    }
+
+    #[tokio::test]
+    async fn a_successful_keys_add_stores_keys_then_settings() {
+        let dir = tempfile::tempdir().unwrap();
+        let settings = store_in(&dir);
+        let calls = RefCell::new(Vec::<String>::new());
+        let saved = add_connection_with(
+            keys_conn(),
+            Some(keys()),
+            |c| async move {
+                assert!(matches!(c, Credentials::Keys(..)));
+                Ok(ident())
+            },
+            |id, _| { calls.borrow_mut().push(format!("store {id}")); Ok(()) },
+            |id| { calls.borrow_mut().push(format!("delete {id}")); Ok(()) },
+            &settings,
+        )
+        .await
+        .unwrap();
+        assert_eq!(*calls.borrow(), vec!["store c2".to_string()]);
+        assert_eq!(settings.get().hosts, vec![saved]);
+    }
+
+    #[tokio::test]
+    async fn keys_are_removed_if_saving_settings_fails() {
+        let dir = tempfile::tempdir().unwrap();
+        // The parent directory does not exist, so saving fails.
+        let settings = SettingsStore::at_path(dir.path().join("missing/settings.json"));
+        let calls = RefCell::new(Vec::<String>::new());
+        let err = add_connection_with(
+            keys_conn(),
+            Some(keys()),
+            |_| async { Ok(ident()) },
+            |id, _| { calls.borrow_mut().push(format!("store {id}")); Ok(()) },
+            |id| { calls.borrow_mut().push(format!("delete {id}")); Ok(()) },
+            &settings,
+        )
+        .await
+        .unwrap_err();
+        assert!(matches!(err, AwsError::Other { .. }));
+        assert_eq!(*calls.borrow(), vec!["store c2".to_string(), "delete c2".to_string()]);
+        assert!(settings.get().hosts.is_empty(), "no unsaved connection in memory");
+    }
+
+    #[tokio::test]
+    async fn a_non_sso_identity_error_on_a_profile_saves_nothing() {
+        let dir = tempfile::tempdir().unwrap();
+        let settings = store_in(&dir);
+        let err = add_connection_with(
+            profile_conn(),
+            None,
+            |_| async { Err(AwsError::ProfileNotFound { profile: "dev".into() }) },
+            |_, _| Ok(()),
+            |_| Ok(()),
+            &settings,
+        )
+        .await
+        .unwrap_err();
+        assert!(matches!(err, AwsError::ProfileNotFound { .. }));
+        assert!(settings.get().hosts.is_empty());
+        assert!(!dir.path().join("settings.json").exists());
+    }
+
+    #[tokio::test]
+    async fn a_failing_store_keys_saves_nothing() {
+        let dir = tempfile::tempdir().unwrap();
+        let settings = store_in(&dir);
+        let deletes = RefCell::new(0);
+        let err = add_connection_with(
+            keys_conn(),
+            Some(keys()),
+            |_| async { Ok(ident()) },
+            |_, _| Err("keychain locked".to_string()),
+            |_| { *deletes.borrow_mut() += 1; Ok(()) },
+            &settings,
+        )
+        .await
+        .unwrap_err();
+        assert!(matches!(err, AwsError::Other { .. }));
+        assert!(settings.get().hosts.is_empty());
+        assert!(!dir.path().join("settings.json").exists());
+    }
+
+    #[test]
+    fn a_keys_connection_whose_keyring_ref_differs_from_its_id_is_refused() {
+        let mut s = AppSettings::default();
+        let mut c = keys_conn();
+        c.kind = HostKind::Aws {
+            auth: AwsAuth::Keys { keyring_ref: "other".into() },
+            default_region: "us-west-2".into(),
+        };
+        s.hosts.push(c);
+        assert!(aws_conn("c2", &s).is_err());
+        s.hosts = vec![keys_conn()];
+        assert!(aws_conn("c2", &s).is_ok());
+    }
+
+    #[test]
+    fn stored_regions_and_profiles_are_revalidated() {
+        let with = |profile: &str, region: &str| {
+            let mut c = profile_conn();
+            c.kind = HostKind::Aws {
+                auth: AwsAuth::Profile { name: profile.into() },
+                default_region: region.into(),
+            };
+            let mut s = AppSettings::default();
+            s.hosts.push(c);
+            s
+        };
+        assert!(aws_conn("c1", &with("dev", "us-west-2")).is_ok());
+        assert!(aws_conn("c1", &with("dev", "not a region")).is_err());
+        assert!(aws_conn("c1", &with("a b", "us-west-2")).is_err());
+    }
+
+    #[test]
+    fn a_connection_with_an_invalid_stored_region_can_still_be_removed() {
+        let dir = tempfile::tempdir().unwrap();
+        let settings = store_in(&dir);
+        let mut c = keys_conn();
+        c.kind = HostKind::Aws {
+            auth: AwsAuth::Keys { keyring_ref: "c2".into() },
+            default_region: "not a region".into(),
+        };
+        settings.update(AppSettings { hosts: vec![c, profile_conn()], ..AppSettings::default() }).unwrap();
+        let deleted = RefCell::new(Vec::<String>::new());
+        let after = remove_connection_with(
+            "c2",
+            |id| { deleted.borrow_mut().push(id.to_string()); Ok(()) },
+            &settings,
+        )
+        .unwrap();
+        assert_eq!(after.hosts, vec![profile_conn()]);
+        assert_eq!(settings.get().hosts, vec![profile_conn()]);
+        assert_eq!(*deleted.borrow(), vec!["c2".to_string()]);
+    }
+
+    #[test]
+    fn removal_leaves_the_keychain_alone_when_keyring_ref_is_not_the_id() {
+        let dir = tempfile::tempdir().unwrap();
+        let settings = store_in(&dir);
+        let mut c = keys_conn();
+        c.kind = HostKind::Aws {
+            auth: AwsAuth::Keys { keyring_ref: "someone-else".into() },
+            default_region: "us-west-2".into(),
+        };
+        settings.update(AppSettings { hosts: vec![c], ..AppSettings::default() }).unwrap();
+        remove_connection_with("c2", |_| panic!("must not touch the keychain"), &settings).unwrap();
+        assert!(settings.get().hosts.is_empty());
+        assert!(remove_connection_with("c2", |_| Ok(()), &settings).is_err());
+        assert!(remove_connection_with("bad id!", |_| Ok(()), &settings).is_err());
+    }
+
+    #[test]
+    fn china_and_govcloud_regions_are_refused_for_connections() {
+        for r in ["cn-north-1", "us-gov-west-1"] {
+            let e = validated("Prod", r).unwrap_err();
+            assert!(matches!(&e, AwsError::Other { message } if message == "China and GovCloud regions aren't supported yet."), "{e:?}");
+        }
+        assert!(validated("Prod", "eu-west-1").is_ok());
+    }
+
+    #[test]
+    fn the_policy_document_is_every_file_of_the_tier() {
+        let admin = aws_policy_document(Tier::EnvironmentAdmin);
+        let names: Vec<&str> = admin.iter().map(|f| f.name.as_str()).collect();
+        assert_eq!(names, ["environment-admin.json", "environment-admin-network.json"]);
+        for f in &admin {
+            serde_json::from_str::<serde_json::Value>(&f.json).expect("policy JSON");
+        }
+        let ws = aws_policy_document(Tier::WorkspaceUser);
+        let names: Vec<&str> = ws.iter().map(|f| f.name.as_str()).collect();
+        assert_eq!(names, ["workspace-user.json", "workspace-user-tasks.json"]);
+        for f in &ws {
+            serde_json::from_str::<serde_json::Value>(&f.json).expect("policy JSON");
+        }
+        assert_eq!(
+            serde_json::to_value(&ws[0]).unwrap()["name"],
+            "workspace-user.json"
+        );
+    }
+}

app/src-tauri/src/commands/inspect_commands.rs

@@ -12,8 +12,9 @@
 //!
 //! ## Container access
 //!
-//! All work happens inside the container via the existing `docker exec`
-//! plumbing in [`crate::docker::exec`] — no second mechanism is introduced.
+//! All work happens inside the container via the existing exec plumbing,
+//! reached through [`crate::host::ContainerTarget`] — no second mechanism is
+//! introduced.
 //! The heavy lifting (walking dirs, grepping transcripts, parsing JSON with
 //! `jq`) runs *in* the container and only a small JSON summary crosses the
 //! wire, so multi-megabyte transcripts are never streamed back.
@@ -56,14 +57,11 @@
 //! commands fail loudly, since they cannot do anything useful without a
 //! running container.
 
-use bollard::exec::{CreateExecOptions, StartExecOptions};
 use serde::{Deserialize, Serialize};
 use tauri::State;
 
-use crate::docker::client::get_docker;
-use crate::docker::container::is_container_running;
-use crate::docker::exec::{exec_oneshot_env, exec_oneshot_env_status};
 use crate::docker::CONTAINER_HOME;
+use crate::host::{ContainerTarget, ExecSpec};
 use crate::AppState;
 
 /// Newest N session transcripts to inspect. Caps the work done inside the
@@ -192,7 +190,7 @@ pub struct SchedulerNotification {
 // Shared helpers
 // ─────────────────────────────────────────────────────────────────────────────
 
-/// Resolve a project to a *running* container id.
+/// Resolve a project to its *running* container.
 ///
 /// `Ok(None)` means "there is nothing to inspect" — no container recorded, or
 /// the container exists but is stopped. Callers that are read-only turn that
@@ -201,19 +199,19 @@ pub struct SchedulerNotification {
 async fn running_container_for(
     project_id: &str,
     state: &State<'_, AppState>,
-) -> Result<Option<String>, String> {
+) -> Result<Option<ContainerTarget>, String> {
     let project = state
         .projects_store
         .get(project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = match project.container_id {
-        Some(id) => id,
+    let target = match ContainerTarget::for_project(&project) {
+        Some(t) => t,
         None => return Ok(None),
     };
 
-    if is_container_running(&container_id).await.unwrap_or(false) {
-        Ok(Some(container_id))
+    if target.is_running().await.unwrap_or(false) {
+        Ok(Some(target))
     } else {
         Ok(None)
     }
@@ -224,7 +222,7 @@ async fn running_container_for(
 async fn require_running_container(
     project_id: &str,
     state: &State<'_, AppState>,
-) -> Result<String, String> {
+) -> Result<ContainerTarget, String> {
     running_container_for(project_id, state).await?.ok_or_else(|| {
         "Container is not running — start the project first.".to_string()
     })
@@ -240,13 +238,13 @@ fn home_env() -> Vec<String> {
 /// the first line) so the combined stream `exec_oneshot_env` returns is pure
 /// stdout and stays parseable as JSON. A non-zero exit therefore surfaces as
 /// empty output, which the callers treat as "nothing to report".
-async fn run_script(container_id: &str, script: impl Into<String>) -> Result<String, String> {
-    exec_oneshot_env(
-        container_id,
-        vec!["sh".to_string(), "-c".to_string(), script.into()],
-        home_env(),
-    )
-    .await
+async fn run_script(target: &ContainerTarget, script: impl Into<String>) -> Result<String, String> {
+    target
+        .exec_oneshot_env(
+            vec!["sh".to_string(), "-c".to_string(), script.into()],
+            home_env(),
+        )
+        .await
 }
 
 /// Parse script output as JSON, degrading to a default value (and a log line)
@@ -315,11 +313,11 @@ pub(crate) fn validate_session_id(id: &str) -> Result<(), String> {
 /// Run `triple-c-scheduler <args…>` as a bare argv vector — no shell is
 /// involved, so caller-supplied ids cannot be interpreted as shell syntax.
 /// Returns the combined output, erroring with it on a non-zero exit.
-async fn run_scheduler(container_id: &str, args: Vec<String>) -> Result<String, String> {
+async fn run_scheduler(target: &ContainerTarget, args: Vec<String>) -> Result<String, String> {
     let mut cmd = vec!["triple-c-scheduler".to_string()];
     cmd.extend(args);
 
-    let (output, exit_code) = exec_oneshot_env_status(container_id, cmd, home_env()).await?;
+    let (output, exit_code) = target.exec_oneshot_env_status(cmd, home_env()).await?;
     if exit_code != 0 {
         let detail = output.trim();
         return Err(if detail.is_empty() {
@@ -395,8 +393,8 @@ pub async fn list_claude_sessions(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<Vec<ClaudeSession>, String> {
-    let container_id = match running_container_for(&project_id, &state).await? {
-        Some(id) => id,
+    let target = match running_container_for(&project_id, &state).await? {
+        Some(t) => t,
         None => return Ok(Vec::new()),
     };
 
@@ -404,7 +402,7 @@ pub async fn list_claude_sessions(
     // a const usize — never from the caller.
     let script = SESSIONS_SCRIPT.replace("__MAX__", &MAX_SESSIONS.to_string());
 
-    let raw = run_script(&container_id, script).await?;
+    let raw = run_script(&target, script).await?;
     let sessions: Vec<RawSession> = parse_or_default(&raw, "session list");
 
     Ok(sessions
@@ -566,12 +564,12 @@ pub async fn list_container_capabilities(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<ContainerCapabilities, String> {
-    let container_id = match running_container_for(&project_id, &state).await? {
-        Some(id) => id,
+    let target = match running_container_for(&project_id, &state).await? {
+        Some(t) => t,
         None => return Ok(ContainerCapabilities::default()),
     };
 
-    let raw = run_script(&container_id, CAPABILITIES_SCRIPT).await?;
+    let raw = run_script(&target, CAPABILITIES_SCRIPT).await?;
     Ok(parse_or_default(&raw, "container capabilities"))
 }
 
@@ -681,12 +679,12 @@ pub async fn list_scheduled_tasks(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<Vec<ScheduledTask>, String> {
-    let container_id = match running_container_for(&project_id, &state).await? {
-        Some(id) => id,
+    let target = match running_container_for(&project_id, &state).await? {
+        Some(t) => t,
         None => return Ok(Vec::new()),
     };
 
-    let raw = run_script(&container_id, SCHEDULER_LIST_SCRIPT).await?;
+    let raw = run_script(&target, SCHEDULER_LIST_SCRIPT).await?;
     let tasks: Vec<RawScheduledTask> = parse_or_default(&raw, "scheduled tasks");
 
     Ok(tasks
@@ -731,13 +729,13 @@ pub async fn get_scheduled_task_log(
     // Clamped, and an integer by type — cannot carry shell syntax.
     let tail = tail_lines.unwrap_or(200).clamp(1, 5000);
 
-    let container_id = match running_container_for(&project_id, &state).await? {
-        Some(id) => id,
+    let target = match running_container_for(&project_id, &state).await? {
+        Some(t) => t,
         None => return Ok(String::new()),
     };
 
     run_scheduler(
-        &container_id,
+        &target,
         vec![
             "logs".to_string(),
             "--id".to_string(),
@@ -756,15 +754,15 @@ pub async fn get_scheduler_notifications(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<Vec<SchedulerNotification>, String> {
-    let container_id = match running_container_for(&project_id, &state).await? {
-        Some(id) => id,
+    let target = match running_container_for(&project_id, &state).await? {
+        Some(t) => t,
         None => return Ok(Vec::new()),
     };
 
     let script =
         SCHEDULER_NOTIFICATIONS_SCRIPT.replace("__MAX__", &MAX_NOTIFICATIONS.to_string());
 
-    let raw = run_script(&container_id, script).await?;
+    let raw = run_script(&target, script).await?;
     let notifications: Vec<RawNotification> = parse_or_default(&raw, "scheduler notifications");
 
     Ok(notifications
@@ -1140,9 +1138,9 @@ pub async fn add_scheduled_task(
         &schedule,
         working_dir.as_deref(),
     )?;
-    let container_id = require_running_container(&project_id, &state).await?;
+    let target = require_running_container(&project_id, &state).await?;
 
-    let output = run_scheduler(&container_id, input.add_args()).await?;
+    let output = run_scheduler(&target, input.add_args()).await?;
     let task_id = parse_created_task_id(&output).ok_or_else(|| {
         format!(
             "The scheduler did not report a task id. Its output was: {}",
@@ -1200,9 +1198,9 @@ pub async fn update_scheduled_task(
         &schedule,
         working_dir.as_deref(),
     )?;
-    let container_id = require_running_container(&project_id, &state).await?;
+    let target = require_running_container(&project_id, &state).await?;
 
-    let output = run_scheduler(&container_id, input.add_args()).await?;
+    let output = run_scheduler(&target, input.add_args()).await?;
     let new_id = parse_created_task_id(&output).ok_or_else(|| {
         format!(
             "The scheduler did not report a task id, so the original task was left in place. Its output was: {}",
@@ -1211,7 +1209,7 @@ pub async fn update_scheduled_task(
     })?;
 
     run_scheduler(
-        &container_id,
+        &target,
         vec!["remove".to_string(), "--id".to_string(), task_id.clone()],
     )
     .await
@@ -1224,7 +1222,7 @@ pub async fn update_scheduled_task(
 
     if enabled == Some(false) {
         if let Err(e) = run_scheduler(
-            &container_id,
+            &target,
             vec!["disable".to_string(), "--id".to_string(), new_id.clone()],
         )
         .await
@@ -1253,11 +1251,11 @@ pub async fn set_scheduled_task_enabled(
     state: State<'_, AppState>,
 ) -> Result<String, String> {
     validate_task_id(&task_id)?;
-    let container_id = require_running_container(&project_id, &state).await?;
+    let target = require_running_container(&project_id, &state).await?;
 
     let subcommand = if enabled { "enable" } else { "disable" };
     let output = run_scheduler(
-        &container_id,
+        &target,
         vec![subcommand.to_string(), "--id".to_string(), task_id],
     )
     .await?;
@@ -1277,39 +1275,20 @@ pub async fn run_scheduled_task_now(
     state: State<'_, AppState>,
 ) -> Result<String, String> {
     validate_task_id(&task_id)?;
-    let container_id = require_running_container(&project_id, &state).await?;
+    let target = require_running_container(&project_id, &state).await?;
 
-    let docker = get_docker()?;
-    let exec = docker
-        .create_exec(
-            &container_id,
-            CreateExecOptions {
-                attach_stdout: Some(false),
-                attach_stderr: Some(false),
-                // Argv vector — no shell, so `task_id` is inert as data.
-                cmd: Some(vec![
-                    "triple-c-scheduler".to_string(),
-                    "run".to_string(),
-                    "--id".to_string(),
-                    task_id.clone(),
-                ]),
-                env: Some(home_env()),
-                user: Some("claude".to_string()),
-                working_dir: Some("/workspace".to_string()),
-                ..Default::default()
-            },
-        )
-        .await
-        .map_err(|e| format!("Failed to create exec: {}", e))?;
-
-    docker
-        .start_exec(
-            &exec.id,
-            Some(StartExecOptions {
-                detach: true,
-                ..Default::default()
-            }),
-        )
+    // Argv vector — no shell, so `task_id` is inert as data. Stdin, stdout and
+    // stderr are all left unattached; the exec is started detached.
+    let spec = ExecSpec::new(vec![
+        "triple-c-scheduler".to_string(),
+        "run".to_string(),
+        "--id".to_string(),
+        task_id.clone(),
+    ])
+    .env(home_env())
+    .no_stdin();
+    let exec_id = target
+        .exec_detached(spec)
         .await
         .map_err(|e| format!("Failed to start task: {}", e))?;
 
@@ -1317,7 +1296,7 @@ pub async fn run_scheduled_task_now(
         "Triggered scheduler task {} in project {} (detached exec {})",
         task_id,
         project_id,
-        exec.id
+        exec_id
     );
     Ok(format!("Task {} started.", task_id))
 }
@@ -1330,10 +1309,10 @@ pub async fn remove_scheduled_task(
     state: State<'_, AppState>,
 ) -> Result<String, String> {
     validate_task_id(&task_id)?;
-    let container_id = require_running_container(&project_id, &state).await?;
+    let target = require_running_container(&project_id, &state).await?;
 
     let output = run_scheduler(
-        &container_id,
+        &target,
         vec!["remove".to_string(), "--id".to_string(), task_id],
     )
     .await?;
@@ -1346,9 +1325,9 @@ pub async fn clear_scheduler_notifications(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
-    let container_id = require_running_container(&project_id, &state).await?;
+    let target = require_running_container(&project_id, &state).await?;
     run_scheduler(
-        &container_id,
+        &target,
         vec!["notifications".to_string(), "--clear".to_string()],
     )
     .await?;

app/src-tauri/src/commands/marketplace_commands.rs

@@ -7,7 +7,7 @@ use std::collections::{BTreeMap, HashSet};
 use tauri::{AppHandle, Emitter, State};
 use tokio::sync::oneshot;
 
-use crate::docker::container::is_container_running;
+use crate::host::ContainerTarget;
 use crate::marketplace::{self as mk, auth, diff, gh_login, git, MarketplaceManager};
 use crate::models::marketplace::{
     is_valid_commit, is_valid_item_key, AccountMethod, FileDiff, InstallScope, ItemUpdate,
@@ -173,10 +173,7 @@ pub(crate) mod ops {
     /// directories, so an id from outside (an import) must be the shape the
     /// commands mint: a UUID-like `[A-Za-z0-9-]{1,64}`.
     pub fn validate_id(id: &str) -> Result<(), String> {
-        let ok = !id.is_empty()
-            && id.len() <= 64
-            && id.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'-');
-        if ok {
+        if crate::storage::secure::is_valid_connection_id(id) {
             Ok(())
         } else {
             Err("An account or marketplace id is malformed.".to_string())
@@ -944,11 +941,11 @@ pub async fn apply_marketplace_now(
     };
     let mut results = Vec::new();
     for p in projects {
-        let running = match &p.container_id {
-            Some(cid) => is_container_running(cid).await.unwrap_or(false),
-            None => false,
+        let running = match ContainerTarget::for_project(&p) {
+            Some(target) if target.is_running().await.unwrap_or(false) => Some(target),
+            _ => None,
         };
-        if !running {
+        let Some(target) = running else {
             if project_id.is_some() {
                 return Err(format!(
                     "\"{}\" is not running. Its marketplace items are applied when it starts.",
@@ -956,9 +953,8 @@ pub async fn apply_marketplace_now(
                 ));
             }
             continue;
-        }
-        let cid = p.container_id.clone().unwrap_or_default();
-        let report = mk::sync_project(&state.marketplace, &settings, &p, &cid).await;
+        };
+        let report = mk::sync_project(&state.marketplace, &settings, &p, &target).await;
         let _ = app_handle.emit(
             mk::SYNC_FINISHED_EVENT,
             serde_json::json!({ "project_id": p.id, "report": report }),
@@ -1051,13 +1047,13 @@ pub async fn start_marketplace_gh_container_login(
         return Err("Signing in through a container needs a host name without a port.".to_string());
     }
     let project = find_project(&state, &project_id)?;
-    let container_id = project.container_id.clone().ok_or_else(|| {
+    let target = ContainerTarget::for_project(&project).ok_or_else(|| {
         format!(
             "\"{}\" has no container yet. Start it, then try again.",
             project.name
         )
     })?;
-    if !is_container_running(&container_id).await.unwrap_or(false) {
+    if !target.is_running().await.unwrap_or(false) {
         return Err(format!(
             "\"{}\" is not running. Start it, then try again.",
             project.name
@@ -1070,7 +1066,7 @@ pub async fn start_marketplace_gh_container_login(
     }
     let account_id = uuid::Uuid::new_v4().to_string();
     let result =
-        gh_login::run_gh_container_login(&app_handle, &account_id, &container_id, &host, rx).await;
+        gh_login::run_gh_container_login(&app_handle, &account_id, &target, &host, rx).await;
     // `rx` is gone now, so this frees our slot and never a newer login's.
     state.marketplace.release_gh_login().await;
     let token = result?;

app/src-tauri/src/commands/migration_commands.rs

@@ -55,7 +55,8 @@
 
 use tauri::State;
 
-use crate::commands::project_commands::{create_container_for_project, emit_progress};
+use crate::commands::project_commands::emit_progress;
+use crate::docker::{create_container_for_project, default_docker_socket};
 use crate::docker;
 use crate::docker::migration::{self as mig, Recovery};
 use crate::models::{
@@ -431,6 +432,11 @@ pub async fn get_container_staleness(
         .projects_store
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
+    // An AWS task has no local container or snapshot to compare: no claim
+    // either way ("unknown"), and nothing is probed.
+    if project.is_aws() {
+        return Ok(ContainerStaleness::default());
+    }
     let settings = state.settings_store.get();
     let base_image = crate::models::container_config::resolve_image_name(
         &settings.image_source,
@@ -707,6 +713,9 @@ pub async fn migrate_project_to_base(
     app_handle: tauri::AppHandle,
     state: State<'_, AppState>,
 ) -> Result<MigrationReport, String> {
+    if let Some(p) = state.projects_store.get(&project_id) {
+        crate::commands::project_commands::refuse_aws(&p, "Updating to the current base image")?;
+    }
     let _guard = match ActiveGuard::acquire(&project_id) {
         Ok(guard) => guard,
         Err(busy) => return Ok(MigrationReport::failed_preflight(&busy)),
@@ -1810,14 +1819,6 @@ pub(crate) async fn purge_migration_artifacts(project_id: &str) {
     migration_store::clear_ownerless_for_project(project_id);
 }
 
-fn default_docker_socket() -> String {
-    if cfg!(target_os = "windows") {
-        "//./pipe/docker_engine".to_string()
-    } else {
-        "/var/run/docker.sock".to_string()
-    }
-}
-
 fn human_bytes(n: u64) -> String {
     const UNITS: [&str; 5] = ["B", "KiB", "MiB", "GiB", "TiB"];
     let mut v = n as f64;
@@ -1860,7 +1861,7 @@ async fn stage_payload(
     project_id: &str,
     verbatim: &[String],
 ) -> Result<String, String> {
-    use bollard::container::LogOutput;
+    use crate::host::ExecChunk;
     use futures_util::StreamExt;
     use tokio::io::AsyncWriteExt;
 
@@ -1913,14 +1914,14 @@ async fn stage_payload(
 
     while let Some(msg) = output.next().await {
         match msg {
-            Ok(LogOutput::StdOut { message }) => {
+            Ok(ExecChunk::StdOut(message)) => {
                 if let Err(e) = writer.write_all(&message).await {
                     stream_err = Some(format!("Failed to write the staging file: {}", e));
                     break;
                 }
                 total += message.len() as u64;
             }
-            Ok(LogOutput::StdErr { message }) => {
+            Ok(ExecChunk::StdErr(message)) => {
                 stderr_text.push_str(&String::from_utf8_lossy(&message));
             }
             Ok(_) => {}
@@ -1979,7 +1980,7 @@ async fn stage_payload(
 /// anything already present in the base, so collisions should be rare either
 /// way.)
 async fn restore_payload(container_id: &str, host_path: &str) -> Result<(), String> {
-    use bollard::container::LogOutput;
+    use crate::host::ExecChunk;
     use futures_util::StreamExt;
     use tokio::io::{AsyncReadExt, AsyncWriteExt};
 
@@ -2007,7 +2008,7 @@ async fn restore_payload(container_id: &str, host_path: &str) -> Result<(), Stri
         let mut text = String::new();
         while let Some(msg) = output.next().await {
             match msg {
-                Ok(LogOutput::StdErr { message }) | Ok(LogOutput::StdOut { message }) => {
+                Ok(ExecChunk::StdErr(message)) | Ok(ExecChunk::StdOut(message)) => {
                     text.push_str(&String::from_utf8_lossy(&message))
                 }
                 Ok(_) => {}

app/src-tauri/src/commands/mod.rs

@@ -2,10 +2,12 @@ pub mod auth_bridge_commands;
 pub mod auth_token_commands;
 pub mod aws_commands;
 pub mod docker_commands;
+pub mod environment_commands;
 pub mod file_commands;
 pub mod file_viewer_commands;
 pub mod gateway_commands;
 pub mod help_commands;
+pub mod host_commands;
 pub mod inspect_commands;
 pub mod install_helper_commands;
 pub mod marketplace_commands;
@@ -13,6 +15,7 @@ pub mod migration_commands;
 pub mod notes_commands;
 pub mod project_commands;
 pub mod settings_commands;
+pub mod stop_guard;
 pub mod settings_export_commands;
 pub mod stt_commands;
 pub mod terminal_commands;

app/src-tauri/src/commands/settings_commands.rs

@@ -78,6 +78,13 @@ pub(crate) fn restore_marketplace_fields(incoming: &mut AppSettings, stored: &Ap
     incoming.global_marketplace_installs = stored.global_marketplace_installs.clone();
 }
 
+/// Host connections change only through `host_commands` (which validates
+/// them and owns their keychain entries) and settings import, never through
+/// a settings save the frontend posts back.
+pub(crate) fn restore_host_fields(incoming: &mut AppSettings, stored: &AppSettings) {
+    incoming.hosts = stored.hosts.clone();
+}
+
 #[tauri::command]
 pub async fn update_settings(
     mut settings: AppSettings,
@@ -87,6 +94,7 @@ pub async fn update_settings(
 
     validate_settings_update(&before, &settings)?;
     restore_marketplace_fields(&mut settings, &before);
+    restore_host_fields(&mut settings, &before);
 
     let saved = state.settings_store.update(settings)?;
 
@@ -466,4 +474,27 @@ mod tests {
             "the edit the save was for still applies"
         );
     }
+
+    #[test]
+    fn update_settings_cannot_change_hosts() {
+        use crate::models::{AwsAuth, HostConnection, HostKind};
+        let conn = |id: &str, region: &str| HostConnection {
+            id: id.into(),
+            name: "Prod".into(),
+            kind: HostKind::Aws {
+                auth: AwsAuth::Profile { name: "dev".into() },
+                default_region: region.into(),
+            },
+        };
+        let mut stored = AppSettings::default();
+        stored.hosts.push(conn("c1", "us-west-2"));
+        let mut incoming = AppSettings::default();
+        incoming.hosts = vec![conn("c1", "not a region"), conn("evil", "us-east-1")];
+        incoming.auto_check_updates = false;
+
+        restore_host_fields(&mut incoming, &stored);
+
+        assert_eq!(incoming.hosts, stored.hosts);
+        assert!(!incoming.auto_check_updates);
+    }
 }

app/src-tauri/src/commands/settings_export_commands.rs

@@ -43,6 +43,7 @@ use zeroize::Zeroizing;
 
 use std::collections::BTreeMap;
 
+use crate::models::host_connection::{AwsAuth, HostConnection, HostKind};
 use crate::models::marketplace::{AccountMethod, MarketplaceAccount};
 use crate::models::{
     AppSettings, ExportedSecrets, SettingsExportPayload, SettingsImportOutcome,
@@ -138,6 +139,7 @@ fn split_settings_and_secrets(current: AppSettings) -> (AppSettings, ExportedSec
             &settings.marketplace_accounts,
             secure::get_marketplace_token,
         ),
+        aws_connection_keys: exported_aws_connection_keys(&settings.hosts, secure::get_aws_keys),
     };
 
     (settings, secrets)
@@ -184,6 +186,107 @@ fn restore_marketplace_tokens(
     warnings
 }
 
+/// The stored keys of every `Keys` host connection, by connection id, as the
+/// `AwsKeys` JSON. A `Profile` connection holds none. A missing or unreadable
+/// entry is left out, like the other keychain secrets above.
+fn exported_aws_connection_keys(
+    hosts: &[HostConnection],
+    get: impl Fn(&str) -> Result<Option<secure::AwsKeys>, String>,
+) -> BTreeMap<String, String> {
+    hosts
+        .iter()
+        .filter(|h| matches!(&h.kind, HostKind::Aws { auth: AwsAuth::Keys { .. }, .. }))
+        .filter_map(|h| {
+            let keys = get(&h.id).unwrap_or_default()?;
+            Some((h.id.clone(), serde_json::to_string(&keys).ok()?))
+        })
+        .collect()
+}
+
+/// Write each imported set of AWS keys to the keychain, returning a warning
+/// (naming the connection id, never the value) for each that could not be.
+fn restore_aws_connection_keys(
+    keys: &BTreeMap<String, String>,
+    mut store: impl FnMut(&str, &secure::AwsKeys) -> Result<(), String>,
+) -> Vec<String> {
+    let mut warnings = Vec::new();
+    for (id, json) in keys {
+        if json.trim().is_empty() {
+            continue;
+        }
+        let Ok(parsed) = serde_json::from_str::<secure::AwsKeys>(json) else {
+            log::warn!("Settings import: the AWS keys of connection {} are malformed", id);
+            warnings.push(format!(
+                "The AWS access keys of connection {} in the file are malformed; enter them again.",
+                id
+            ));
+            continue;
+        };
+        if let Err(e) = store(id, &parsed) {
+            log::warn!(
+                "Settings import: could not restore the AWS keys of connection {}: {}",
+                id,
+                e
+            );
+            warnings.push(format!(
+                "Could not restore the AWS access keys of connection {} ({}); enter them again.",
+                id, e
+            ));
+        }
+    }
+    warnings
+}
+
+/// Checks the imported host connections with the rules the connection
+/// commands use, before anything is written; refuses the import (like
+/// `validate_imported_marketplace_state`) rather than applying a bad entry.
+/// A `Keys` connection's `keyring_ref` must be its own (valid) id, and keys
+/// may only be carried for a `Keys` connection in the file.
+fn validate_imported_hosts(
+    settings: &mut AppSettings,
+    keys: &BTreeMap<String, String>,
+) -> Result<(), String> {
+    use crate::models::host_connection::{
+        validate_connection_name, validate_profile_name, validate_supported_region,
+    };
+    let wrap = |e: String| format!("The file's host connections were refused: {e}");
+
+    let mut seen = std::collections::HashSet::new();
+    for h in &mut settings.hosts {
+        if !secure::is_valid_connection_id(&h.id) {
+            return Err(wrap("a connection has an invalid id.".into()));
+        }
+        if !seen.insert(h.id.clone()) {
+            return Err(wrap("a connection appears twice.".into()));
+        }
+        h.name = validate_connection_name(&h.name).map_err(wrap)?;
+        let HostKind::Aws { auth, default_region } = &h.kind;
+        validate_supported_region(default_region).map_err(wrap)?;
+        match auth {
+            AwsAuth::Profile { name } => {
+                validate_profile_name(name).map_err(wrap)?;
+            }
+            AwsAuth::Keys { keyring_ref } => {
+                if !secure::is_valid_connection_id(keyring_ref) || *keyring_ref != h.id {
+                    return Err(wrap(format!(
+                        "the connection \"{}\" has an invalid key reference.",
+                        h.name
+                    )));
+                }
+            }
+        }
+    }
+    for id in keys.keys() {
+        let is_keys_connection = settings.hosts.iter().any(|h| {
+            h.id == *id && matches!(&h.kind, HostKind::Aws { auth: AwsAuth::Keys { .. }, .. })
+        });
+        if !is_keys_connection {
+            return Err(wrap("access keys are present for an unknown connection.".into()));
+        }
+    }
+    Ok(())
+}
+
 /// Export the current global settings and secrets to a password-encrypted
 /// file. `Ok(false)` means the save dialog was dismissed — not an error, and
 /// deliberately distinguishable from one so the frontend shows nothing
@@ -260,7 +363,8 @@ pub async fn preview_settings_import(
 
     let encrypted = std::fs::read(&path).map_err(|e| format!("Failed to read export file: {}", e))?;
     let payload = read_and_decrypt_bytes(&encrypted, &password)?;
-    let preview = SettingsImportPreview::from_payload(&payload);
+    let local_hosts = state.settings_store.get().hosts;
+    let preview = SettingsImportPreview::from_payload_against(&payload, &local_hosts, secure::aws_keys_entry_state);
 
     *state.pending_settings_import.lock().await = Some(PendingSettingsImport {
         path,
@@ -376,6 +480,9 @@ pub async fn apply_settings_import(
         &marketplace_tokens,
     )?;
 
+    let aws_keys = payload.secrets.aws_connection_keys;
+    validate_imported_hosts(&mut settings, &aws_keys)?;
+
     let mut secret_restore_warnings = Vec::new();
     let mut gateway_secret_changed = false;
 
@@ -423,24 +530,20 @@ pub async fn apply_settings_import(
         secure::store_marketplace_token,
     ));
 
-    let imported_marketplace = (
-        settings.marketplace_accounts.clone(),
-        settings.marketplaces.clone(),
-        settings.global_marketplace_installs.clone(),
-    );
+    secret_restore_warnings.extend(restore_aws_connection_keys(
+        &aws_keys,
+        secure::store_aws_keys,
+    ));
+
+    let imported_owned = StoreOwned::of(&settings);
     let saved =
         crate::commands::settings_commands::update_settings(settings, state.clone()).await?;
-    // `update_settings` keeps marketplace state store-owned. An import is the
-    // one caller entitled to replace it wholesale.
-    let saved = {
-        let mut s = saved;
-        (
-            s.marketplace_accounts,
-            s.marketplaces,
-            s.global_marketplace_installs,
-        ) = imported_marketplace;
-        state.settings_store.update(s)?
-    };
+    // `update_settings` keeps marketplace state and host connections
+    // store-owned. An import is the one caller entitled to replace them
+    // wholesale.
+    let saved = state
+        .settings_store
+        .update(imported_owned.applied_to(saved))?;
     // Caches of marketplaces the import dropped are dead weight now, and
     // the pins must match the imported installs.
     use crate::commands::marketplace_commands as mc;
@@ -481,6 +584,34 @@ pub async fn apply_settings_import(
     })
 }
 
+/// The settings `update_settings` keeps store-owned (marketplace state and
+/// host connections), which an import re-applies after that call.
+struct StoreOwned {
+    marketplace_accounts: Vec<crate::models::marketplace::MarketplaceAccount>,
+    marketplaces: Vec<crate::models::marketplace::Marketplace>,
+    global_marketplace_installs: Vec<crate::models::marketplace::MarketplaceInstall>,
+    hosts: Vec<crate::models::HostConnection>,
+}
+
+impl StoreOwned {
+    fn of(s: &AppSettings) -> Self {
+        Self {
+            marketplace_accounts: s.marketplace_accounts.clone(),
+            marketplaces: s.marketplaces.clone(),
+            global_marketplace_installs: s.global_marketplace_installs.clone(),
+            hosts: s.hosts.clone(),
+        }
+    }
+
+    fn applied_to(self, mut s: AppSettings) -> AppSettings {
+        s.marketplace_accounts = self.marketplace_accounts;
+        s.marketplaces = self.marketplaces;
+        s.global_marketplace_installs = self.global_marketplace_installs;
+        s.hosts = self.hosts;
+        s
+    }
+}
+
 fn non_blank(value: Option<String>) -> Option<String> {
     value.filter(|v| !v.trim().is_empty())
 }
@@ -827,4 +958,141 @@ mod tests {
         assert_eq!(warnings.len(), 1);
         assert!(!warnings[0].contains("test-token-not-real"));
     }
+
+    fn keys_host(id: &str) -> HostConnection {
+        HostConnection {
+            id: id.into(),
+            name: "Prod".into(),
+            kind: HostKind::Aws {
+                auth: AwsAuth::Keys { keyring_ref: id.into() },
+                default_region: "us-west-2".into(),
+            },
+        }
+    }
+
+    fn profile_host(id: &str) -> HostConnection {
+        HostConnection {
+            id: id.into(),
+            name: "Dev".into(),
+            kind: HostKind::Aws {
+                auth: AwsAuth::Profile { name: "default".into() },
+                default_region: "us-west-2".into(),
+            },
+        }
+    }
+
+    fn test_keys() -> secure::AwsKeys {
+        secure::AwsKeys {
+            access_key_id: "AKIATESTNOTREAL".into(),
+            secret_access_key: "test-secret-not-real".into(),
+            session_token: None,
+        }
+    }
+
+    #[test]
+    fn aws_connection_keys_round_trip_through_export() {
+        let hosts = vec![keys_host("k1"), profile_host("p1")];
+        let exported = exported_aws_connection_keys(&hosts, |id| match id {
+            "k1" => Ok(Some(test_keys())),
+            other => panic!("only a Keys connection is read, got {other}"),
+        });
+        assert_eq!(exported.keys().collect::<Vec<_>>(), vec!["k1"]);
+        assert_eq!(serde_json::from_str::<secure::AwsKeys>(&exported["k1"]).unwrap(), test_keys());
+
+        let mut stored = Vec::new();
+        let warnings = restore_aws_connection_keys(&exported, |id, keys| {
+            stored.push((id.to_string(), keys.clone()));
+            Ok(())
+        });
+        assert!(warnings.is_empty());
+        assert_eq!(stored, vec![("k1".to_string(), test_keys())]);
+    }
+
+    #[test]
+    fn aws_connection_keys_restore_failures_name_the_id_not_the_value() {
+        let keys = BTreeMap::from([
+            ("bad".to_string(), "not json test-secret-not-real".to_string()),
+            ("locked".to_string(), serde_json::to_string(&test_keys()).unwrap()),
+        ]);
+        let warnings = restore_aws_connection_keys(&keys, |_, _| Err("keychain locked".into()));
+        assert_eq!(warnings.len(), 2);
+        assert!(warnings[0].contains("bad"));
+        assert!(warnings[1].contains("locked"));
+        assert!(warnings.iter().all(|w| !w.contains("test-secret-not-real")));
+    }
+
+    #[test]
+    fn imported_hosts_are_validated() {
+        let check = |hosts: Vec<HostConnection>, keys: BTreeMap<String, String>| {
+            let mut s = AppSettings::default();
+            s.hosts = hosts;
+            validate_imported_hosts(&mut s, &keys)
+        };
+        let none = BTreeMap::new();
+        assert!(check(vec![keys_host("k1"), profile_host("p1")], none.clone()).is_ok());
+        assert!(check(vec![keys_host("k1")], BTreeMap::from([("k1".into(), "{}".into())])).is_ok());
+
+        let mut bad_name = profile_host("p1");
+        bad_name.name = "  ".into();
+        assert!(check(vec![bad_name], none.clone()).is_err());
+
+        let mut bad_region = profile_host("p1");
+        bad_region.kind = HostKind::Aws {
+            auth: AwsAuth::Profile { name: "default".into() },
+            default_region: "nowhere".into(),
+        };
+        assert!(check(vec![bad_region], none.clone()).is_err());
+
+        let mut cn = profile_host("p1");
+        cn.kind = HostKind::Aws {
+            auth: AwsAuth::Profile { name: "default".into() },
+            default_region: "cn-north-1".into(),
+        };
+        let err = check(vec![cn], none.clone()).unwrap_err();
+        assert!(err.contains("China and GovCloud regions aren't supported yet."), "{err}");
+
+        let mut bad_profile = profile_host("p1");
+        bad_profile.kind = HostKind::Aws {
+            auth: AwsAuth::Profile { name: "a b".into() },
+            default_region: "us-west-2".into(),
+        };
+        assert!(check(vec![bad_profile], none.clone()).is_err());
+
+        let mut other_ref = keys_host("k1");
+        other_ref.kind = HostKind::Aws {
+            auth: AwsAuth::Keys { keyring_ref: "someone-else".into() },
+            default_region: "us-west-2".into(),
+        };
+        assert!(check(vec![other_ref], none.clone()).is_err());
+
+        assert!(check(vec![profile_host("../x")], none.clone()).is_err());
+        assert!(check(vec![profile_host("p1"), profile_host("p1")], none.clone()).is_err());
+        // Keys carried for a connection that is not a Keys connection.
+        assert!(check(vec![profile_host("p1")], BTreeMap::from([("p1".into(), "{}".into())])).is_err());
+        assert!(check(vec![], BTreeMap::from([("ghost".into(), "{}".into())])).is_err());
+    }
+
+    #[test]
+    fn imported_hosts_survive_apply() {
+        use crate::models::{AwsAuth, HostConnection, HostKind};
+        let host = HostConnection {
+            id: "h1".into(),
+            name: "Imported".into(),
+            kind: HostKind::Aws {
+                auth: AwsAuth::Profile { name: "dev".into() },
+                default_region: "us-west-2".into(),
+            },
+        };
+        let stored = AppSettings::default();
+        let mut imported = AppSettings::default();
+        imported.hosts.push(host.clone());
+
+        let owned = StoreOwned::of(&imported);
+        // What `update_settings` does to the incoming settings.
+        let mut after_update = imported.clone();
+        crate::commands::settings_commands::restore_host_fields(&mut after_update, &stored);
+        assert!(after_update.hosts.is_empty(), "update_settings drops hosts");
+
+        assert_eq!(owned.applied_to(after_update).hosts, vec![host]);
+    }
 }

app/src-tauri/src/commands/stop_guard.rs

@@ -0,0 +1,458 @@
+//! The AWS stop guard: what `triple-c-wip-push` says about a workspace's
+//! unsaved git work, and the push a Stop may run first.
+//!
+//! The decisions are made over [`WipRunner`] so a fake target exercises them;
+//! [`ContainerTarget`] runs the script through the agent as `claude` (the
+//! script needs the user's credential helper and `~/.ssh`).
+
+use std::future::Future;
+use std::time::Duration;
+
+use crate::host::ContainerTarget;
+use crate::models::{RepoState, UnsavedWork, WipChoice};
+
+/// The script, baked into the image (`container/triple-c-wip-push`).
+pub const WIP_PUSH: &str = "/usr/local/bin/triple-c-wip-push";
+/// A dry run only reads `git status`; it should be quick.
+pub const DRY_RUN_TIMEOUT: Duration = Duration::from_secs(30);
+/// A push goes over the network, once per dirty repo.
+pub const PUSH_TIMEOUT: Duration = Duration::from_secs(300);
+/// Cap on the push output carried into an error.
+const MAX_OUTPUT: usize = 4000;
+/// How much sooner than the client's timeout the in-container `timeout`
+/// ends the script (its TERM, then 5 s to the KILL): an exec the client gives
+/// up on is not killed by the agent, so the container bounds it itself.
+const IN_CONTAINER_MARGIN: Duration = Duration::from_secs(10);
+
+/// Where the entrypoint's stop hook looks for the app's decision (Task 7's
+/// file, which the idle watcher also writes `idle` to).
+pub const STOP_REASON_FILE: &str = "/run/triple-c/stop-reason";
+/// Recorded after the guard's push succeeded: the hook does not push again.
+pub const MARKER_PUSHED: &str = "pushed";
+/// Recorded for "Stop without pushing": the hook does not push.
+pub const MARKER_DISCARD: &str = "discard";
+
+/// The workspace, as the stop guard uses it.
+pub trait WipRunner: Sync {
+    /// Run the WIP script as `claude`: `(combined output, exit code)`. The
+    /// caller waits at most `limit`; the run must not outlive it.
+    fn run(
+        &self,
+        args: Vec<String>,
+        limit: Duration,
+    ) -> impl Future<Output = Result<(String, i64), String>> + Send;
+    /// Record `marker` in [`STOP_REASON_FILE`] (as root: the directory is root's).
+    fn write_stop_reason(&self, marker: &str) -> impl Future<Output = Result<(), String>> + Send;
+    /// Remove [`STOP_REASON_FILE`] (as root), so the hook pushes as configured again.
+    fn clear_stop_reason(&self) -> impl Future<Output = Result<(), String>> + Send;
+}
+
+impl WipRunner for ContainerTarget {
+    async fn run(&self, args: Vec<String>, limit: Duration) -> Result<(String, i64), String> {
+        self.exec_oneshot_as("claude", wip_command(args, limit), Vec::new()).await
+    }
+
+    async fn write_stop_reason(&self, marker: &str) -> Result<(), String> {
+        let (out, code) = self
+            .exec_oneshot_as("root", stop_reason_command(marker), Vec::new())
+            .await?;
+        if code == 0 {
+            Ok(())
+        } else {
+            Err(format!("exit {code}: {}", cap(&out)))
+        }
+    }
+
+    async fn clear_stop_reason(&self) -> Result<(), String> {
+        let (out, code) = self
+            .exec_oneshot_as("root", clear_stop_reason_command(), Vec::new())
+            .await?;
+        if code == 0 {
+            Ok(())
+        } else {
+            Err(format!("exit {code}: {}", cap(&out)))
+        }
+    }
+}
+
+/// The script's argv under coreutils `timeout`, ending it
+/// [`IN_CONTAINER_MARGIN`] before the client's `limit` (KILL 5 s after the
+/// TERM), so a push the app gave up on is not left running in the workspace.
+pub fn wip_command(args: Vec<String>, limit: Duration) -> Vec<String> {
+    let secs = limit.saturating_sub(IN_CONTAINER_MARGIN).as_secs().max(1);
+    let mut cmd = vec![
+        "/usr/bin/timeout".to_string(),
+        "-k".to_string(),
+        "5".to_string(),
+        secs.to_string(),
+        WIP_PUSH.to_string(),
+    ];
+    cmd.extend(args);
+    cmd
+}
+
+/// The root command that forgets a recorded marker (a fixed argv).
+pub fn clear_stop_reason_command() -> Vec<String> {
+    vec!["rm".into(), "-f".into(), STOP_REASON_FILE.into()]
+}
+
+/// After StopTask failed: the workspace keeps running, so a marker this stop
+/// recorded must not suppress the push of a later stop (Spot, ECS, idle) the
+/// user never chose for. Best effort; logged.
+pub async fn forget_choice<R: WipRunner>(runner: Option<&R>, choice: Option<WipChoice>) {
+    if choice.is_none() {
+        return;
+    }
+    let Some(r) = runner else {
+        log::warn!("Stop failed and the workspace is unreachable; its stop marker may remain");
+        return;
+    };
+    match tokio::time::timeout(DRY_RUN_TIMEOUT, r.clear_stop_reason()).await {
+        Ok(Ok(())) => {}
+        Ok(Err(e)) => log::warn!("Could not remove the stop marker after a failed stop: {e}"),
+        Err(_) => log::warn!("Removing the stop marker after a failed stop timed out"),
+    }
+}
+
+/// The root command that records `marker`; the value travels as `$1`, never
+/// inside the script.
+pub fn stop_reason_command(marker: &str) -> Vec<String> {
+    vec![
+        "sh".into(),
+        "-c".into(),
+        format!(
+            "umask 077 && mkdir -p /run/triple-c && chmod 700 /run/triple-c && printf '%s\\n' \"$1\" > {STOP_REASON_FILE}"
+        ),
+        "sh".into(),
+        marker.into(),
+    ]
+}
+
+/// The repository lines of a dry run. Lines that are not JSON objects (a
+/// warning on stderr) are skipped; a JSON line of the wrong shape is an error.
+pub fn parse_dry_run(output: &str) -> Result<Vec<RepoState>, String> {
+    output
+        .lines()
+        .map(str::trim)
+        .filter(|l| l.starts_with('{'))
+        .map(|l| {
+            serde_json::from_str::<RepoState>(l)
+                .map_err(|e| format!("Unexpected output from the WIP check: {e}"))
+        })
+        .collect()
+}
+
+fn unchecked(reason: String) -> UnsavedWork {
+    UnsavedWork { checked: false, repos: Vec::new(), error: Some(reason) }
+}
+
+/// Ask the workspace what a stop would lose. `runner` is `None` when the
+/// workspace's agent is not reachable (no tunnel).
+pub async fn unsaved_work<R: WipRunner>(runner: Option<&R>, timeout: Duration) -> UnsavedWork {
+    let Some(runner) = runner else {
+        return unchecked(
+            "Triple-C is not connected to the workspace, so it can't check for unsaved work."
+                .into(),
+        );
+    };
+    let res = tokio::time::timeout(timeout, runner.run(vec!["--dry-run".into()], timeout)).await;
+    match res {
+        Err(_) => unchecked("The workspace did not answer the check for unsaved work in time.".into()),
+        Ok(Err(e)) => unchecked(format!("The workspace could not be asked about unsaved work: {e}")),
+        Ok(Ok((out, code))) if code != 0 => unchecked(format!(
+            "The check for unsaved work failed (exit {code}): {}",
+            cap(&out)
+        )),
+        Ok(Ok((out, _))) => match parse_dry_run(&out) {
+            Ok(repos) => UnsavedWork { checked: true, repos, error: None },
+            Err(e) => unchecked(e),
+        },
+    }
+}
+
+fn cap(s: &str) -> String {
+    let t = s.trim();
+    if t.len() <= MAX_OUTPUT {
+        return t.to_string();
+    }
+    let mut end = t.len() - MAX_OUTPUT;
+    while !t.is_char_boundary(end) {
+        end += 1;
+    }
+    format!("…{}", &t[end..])
+}
+
+/// What Stop does before stopping, given the user's choice. `Push` runs the
+/// push and fails (aborting the stop) with its output when it does not
+/// succeed; `Discard` and no choice do nothing.
+pub async fn before_stop<R: WipRunner>(
+    runner: Option<&R>,
+    choice: Option<WipChoice>,
+    timeout: Duration,
+) -> Result<(), String> {
+    if choice != Some(WipChoice::Push) {
+        return Ok(());
+    }
+    let runner = runner.ok_or_else(|| {
+        "Triple-C is not connected to the workspace, so it can't push unsaved work. The \
+         workspace was not stopped."
+            .to_string()
+    })?;
+    let res =
+        tokio::time::timeout(timeout, runner.run(vec!["--reason".into(), "stop".into()], timeout)).await;
+    match res {
+        Err(_) => Err("Pushing unsaved work did not finish in time. The workspace was not stopped.".into()),
+        Ok(Err(e)) => Err(format!("Could not push unsaved work: {e}. The workspace was not stopped.")),
+        Ok(Ok((out, 0))) => {
+            log::info!("WIP push before stop: {}", cap(&out));
+            Ok(())
+        }
+        Ok(Ok((out, code))) => Err(format!(
+            "Pushing unsaved work failed (exit {code}), so the workspace was not stopped:\n{}",
+            cap(&out)
+        )),
+    }
+}
+
+/// The note a stop returns when the hook's own push may still run.
+pub const MARKER_NOT_RECORDED: &str = "Triple-C could not tell the workspace what you chose, so its own \
+     push of work in progress on shutdown may still run (if it is turned on).";
+
+/// Everything the guard does before StopTask: `Push` pushes (a failure is an
+/// `Err` and the stop must not happen), then records `pushed`; `Discard`
+/// records `discard`; no choice does nothing. A marker that can't be
+/// written does not stop the stop: `Ok(Some(note))` says the hook may push.
+pub async fn prepare_stop<R: WipRunner>(
+    runner: Option<&R>,
+    choice: Option<WipChoice>,
+    push_timeout: Duration,
+) -> Result<Option<String>, String> {
+    let marker = match choice {
+        None => return Ok(None),
+        Some(WipChoice::Push) => {
+            before_stop(runner, choice, push_timeout).await?;
+            MARKER_PUSHED
+        }
+        Some(WipChoice::Discard) => MARKER_DISCARD,
+    };
+    let written = match runner {
+        Some(r) => tokio::time::timeout(DRY_RUN_TIMEOUT, r.write_stop_reason(marker))
+            .await
+            .unwrap_or_else(|_| Err("timed out".into())),
+        None => Err("not connected to the workspace".into()),
+    };
+    match written {
+        Ok(()) => Ok(None),
+        Err(e) => {
+            log::warn!("Could not record the stop guard's choice ({marker}): {e}");
+            Ok(Some(MARKER_NOT_RECORDED.to_string()))
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+    use std::sync::Mutex;
+
+    pub(crate) struct Fake {
+        pub reply: Result<(String, i64), String>,
+        pub calls: Mutex<Vec<Vec<String>>>,
+        pub hang: bool,
+        pub markers: Mutex<Vec<String>>,
+        pub marker_fails: bool,
+    }
+
+    impl Fake {
+        pub fn new(reply: Result<(String, i64), String>) -> Self {
+            Fake { reply, calls: Mutex::new(Vec::new()), hang: false, markers: Mutex::new(Vec::new()), marker_fails: false }
+        }
+        fn markers(&self) -> Vec<String> {
+            self.markers.lock().unwrap().clone()
+        }
+        fn calls(&self) -> Vec<Vec<String>> {
+            self.calls.lock().unwrap().clone()
+        }
+    }
+
+    impl WipRunner for Fake {
+        async fn run(&self, args: Vec<String>, _limit: Duration) -> Result<(String, i64), String> {
+            self.calls.lock().unwrap().push(args);
+            if self.hang {
+                std::future::pending::<()>().await;
+            }
+            self.reply.clone()
+        }
+        async fn write_stop_reason(&self, marker: &str) -> Result<(), String> {
+            if self.marker_fails {
+                return Err("agent unreachable".into());
+            }
+            self.markers.lock().unwrap().push(marker.to_string());
+            Ok(())
+        }
+        async fn clear_stop_reason(&self) -> Result<(), String> {
+            self.markers.lock().unwrap().push("<cleared>".to_string());
+            Ok(())
+        }
+    }
+
+    const T: Duration = Duration::from_secs(5);
+
+    #[test]
+    fn a_dry_run_is_parsed_skipping_non_json_lines() {
+        let out = "warning: something\n{\"folder\":\"api\",\"dirty\":true,\"unpushed\":0,\"branch\":\"main\"}\n\
+                   {\"folder\":\"web\",\"dirty\":false,\"unpushed\":2,\"branch\":\"HEAD\"}\n";
+        let repos = parse_dry_run(out).unwrap();
+        assert_eq!(repos.len(), 2);
+        assert_eq!(repos[0], RepoState { folder: "api".into(), dirty: true, unpushed: 0, branch: "main".into(), cloning: false });
+        assert_eq!(repos[1].unpushed, 2);
+        assert!(parse_dry_run("{\"folder\":1}").is_err());
+        assert!(parse_dry_run("").unwrap().is_empty());
+    }
+
+    #[tokio::test]
+    async fn the_check_runs_a_dry_run_and_reports_the_repos() {
+        let fake = Fake::new(Ok(("{\"folder\":\"a\",\"dirty\":false,\"unpushed\":0,\"branch\":\"main\"}".into(), 0)));
+        let w = unsaved_work(Some(&fake), T).await;
+        assert!(w.checked && w.error.is_none());
+        assert_eq!(w.repos.len(), 1);
+        assert_eq!(fake.calls(), vec![vec!["--dry-run".to_string()]]);
+    }
+
+    #[tokio::test]
+    async fn an_unreachable_workspace_is_unchecked_with_a_reason() {
+        let w = unsaved_work::<Fake>(None, T).await;
+        assert!(!w.checked);
+        assert!(w.error.as_deref().unwrap().contains("not connected"));
+
+        let failing = Fake::new(Err("connection refused".into()));
+        let w = unsaved_work(Some(&failing), T).await;
+        assert!(!w.checked && w.error.unwrap().contains("connection refused"));
+
+        let nonzero = Fake::new(Ok(("boom".into(), 2)));
+        let w = unsaved_work(Some(&nonzero), T).await;
+        assert!(!w.checked && w.error.unwrap().contains("exit 2"));
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn a_check_that_hangs_times_out_unchecked() {
+        let mut fake = Fake::new(Ok((String::new(), 0)));
+        fake.hang = true;
+        let w = unsaved_work(Some(&fake), Duration::from_secs(1)).await;
+        assert!(!w.checked && w.error.unwrap().contains("in time"));
+    }
+
+    #[tokio::test]
+    async fn push_runs_the_script_with_reason_stop() {
+        let fake = Fake::new(Ok(("pushed".into(), 0)));
+        before_stop(Some(&fake), Some(WipChoice::Push), T).await.unwrap();
+        assert_eq!(fake.calls(), vec![vec!["--reason".to_string(), "stop".to_string()]]);
+    }
+
+    #[tokio::test]
+    async fn a_failed_push_aborts_with_its_output() {
+        let fake = Fake::new(Ok(("triple-c-wip-push: api: push to origin failed: denied".into(), 1)));
+        let e = before_stop(Some(&fake), Some(WipChoice::Push), T).await.unwrap_err();
+        assert!(e.contains("push to origin failed: denied"), "{e}");
+        assert!(e.contains("not stopped"));
+
+        let gone = Fake::new(Err("tunnel closed".into()));
+        assert!(before_stop(Some(&gone), Some(WipChoice::Push), T).await.unwrap_err().contains("tunnel closed"));
+        assert!(before_stop::<Fake>(None, Some(WipChoice::Push), T).await.is_err());
+    }
+
+    #[tokio::test]
+    async fn discard_or_no_choice_runs_nothing() {
+        let fake = Fake::new(Err("must not run".into()));
+        before_stop(Some(&fake), Some(WipChoice::Discard), T).await.unwrap();
+        before_stop(Some(&fake), None, T).await.unwrap();
+        before_stop::<Fake>(None, None, T).await.unwrap();
+        assert!(fake.calls().is_empty());
+    }
+
+    #[test]
+    fn the_script_is_bounded_inside_the_workspace_before_the_client_gives_up() {
+        let cmd = wip_command(vec!["--reason".into(), "stop".into()], PUSH_TIMEOUT);
+        assert_eq!(cmd, vec!["/usr/bin/timeout", "-k", "5", "290", WIP_PUSH, "--reason", "stop"]);
+        let secs: u64 = cmd[3].parse().unwrap();
+        assert!(secs + 5 < PUSH_TIMEOUT.as_secs(), "TERM and KILL land before the client's timeout");
+        let dry = wip_command(vec!["--dry-run".into()], DRY_RUN_TIMEOUT);
+        assert_eq!(&dry[3..], &["20", WIP_PUSH, "--dry-run"]);
+        assert_eq!(wip_command(Vec::new(), Duration::from_secs(3))[3], "1", "never 0 (no limit)");
+        // The image has coreutils' timeout where the argv says.
+        let df = include_str!("../../../../container/Dockerfile");
+        assert!(df.contains("ubuntu:24.04") || df.contains("ubuntu:noble"), "coreutils at /usr/bin");
+    }
+
+    #[test]
+    fn a_cloning_repo_parses_with_its_flag_and_older_lines_without_it() {
+        let out = "{\"folder\":\"half\",\"dirty\":false,\"unpushed\":0,\"branch\":\"\",\"cloning\":true}\n\
+                   {\"folder\":\"a\",\"dirty\":true,\"unpushed\":0,\"branch\":\"main\"}";
+        let repos = parse_dry_run(out).unwrap();
+        assert!(repos[0].cloning && !repos[1].cloning);
+    }
+
+    #[test]
+    fn long_output_keeps_its_end() {
+        let s = format!("{}END", "x".repeat(10_000));
+        let c = cap(&s);
+        assert!(c.ends_with("END") && c.len() < 4100);
+    }
+
+    #[tokio::test]
+    async fn a_successful_push_records_pushed_and_stop_without_pushing_records_discard() {
+        let fake = Fake::new(Ok(("pushed".into(), 0)));
+        assert_eq!(prepare_stop(Some(&fake), Some(WipChoice::Push), T).await.unwrap(), None);
+        assert_eq!(fake.markers(), vec![MARKER_PUSHED]);
+
+        let fake = Fake::new(Err("must not run".into()));
+        assert_eq!(prepare_stop(Some(&fake), Some(WipChoice::Discard), T).await.unwrap(), None);
+        assert!(fake.calls().is_empty());
+        assert_eq!(fake.markers(), vec![MARKER_DISCARD]);
+
+        assert_eq!(prepare_stop(Some(&fake), None, T).await.unwrap(), None);
+        assert_eq!(fake.markers().len(), 1, "no choice records nothing");
+    }
+
+    #[tokio::test]
+    async fn a_failed_push_records_nothing() {
+        let fake = Fake::new(Ok(("denied".into(), 1)));
+        assert!(prepare_stop(Some(&fake), Some(WipChoice::Push), T).await.is_err());
+        assert!(fake.markers().is_empty());
+    }
+
+    #[tokio::test]
+    async fn an_unwritable_marker_still_stops_and_says_the_hook_may_push() {
+        let mut fake = Fake::new(Ok((String::new(), 0)));
+        fake.marker_fails = true;
+        let note = prepare_stop(Some(&fake), Some(WipChoice::Discard), T).await.unwrap();
+        assert!(note.unwrap().contains("may still run"));
+        let note = prepare_stop::<Fake>(None, Some(WipChoice::Discard), T).await.unwrap();
+        assert!(note.is_some());
+    }
+
+    #[test]
+    fn the_marker_is_written_as_an_argument_to_the_file_the_hook_reads() {
+        let cmd = stop_reason_command("pushed");
+        assert_eq!(&cmd[..2], &["sh".to_string(), "-c".to_string()]);
+        assert!(cmd[2].contains("> /run/triple-c/stop-reason") && cmd[2].contains("\"$1\""));
+        assert_eq!(cmd.last().unwrap(), "pushed");
+        // The entrypoint matches exactly these values.
+        let ep = include_str!("../../../../container/entrypoint.sh");
+        assert!(ep.contains("pushed|discard)") && ep.contains(STOP_REASON_FILE));
+    }
+
+    #[tokio::test]
+    async fn a_failed_stop_forgets_the_recorded_choice() {
+        let fake = Fake::new(Ok((String::new(), 0)));
+        prepare_stop(Some(&fake), Some(WipChoice::Discard), T).await.unwrap();
+        forget_choice(Some(&fake), Some(WipChoice::Discard)).await;
+        assert_eq!(fake.markers(), vec![MARKER_DISCARD, "<cleared>"]);
+        // An unguarded stop recorded nothing, so there is nothing to forget.
+        let fake = Fake::new(Ok((String::new(), 0)));
+        forget_choice(Some(&fake), None).await;
+        assert!(fake.markers().is_empty());
+        forget_choice::<Fake>(None, Some(WipChoice::Push)).await;
+        assert_eq!(clear_stop_reason_command(), vec!["rm", "-f", "/run/triple-c/stop-reason"]);
+    }
+}

app/src-tauri/src/commands/terminal_commands.rs

@@ -1,6 +1,7 @@
 use tauri::{AppHandle, Emitter, State};
 
 use crate::commands::aws_commands;
+use crate::host::ContainerTarget;
 use crate::models::{Backend, BedrockAuthMethod, Project};
 use crate::AppState;
 
@@ -159,9 +160,9 @@ pub async fn open_terminal_session(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    // Waits while an AWS project's tunnel is being re-opened after a restart.
+    let target = ContainerTarget::for_project_waiting(&project)
+        .await
         .ok_or_else(|| "Container not running".to_string())?;
 
     if let Some(id) = resume_session_id.as_deref() {
@@ -189,7 +190,7 @@ pub async fn open_terminal_session(
     state
         .exec_manager
         .create_session(
-            container_id,
+            &target,
             &session_id,
             cmd,
             move |data| {
@@ -240,7 +241,7 @@ pub async fn paste_image_to_terminal(
     image_data: Vec<u8>,
     state: State<'_, AppState>,
 ) -> Result<String, String> {
-    let container_id = state.exec_manager.get_container_id(&session_id).await?;
+    let target = state.exec_manager.get_target(&session_id).await?;
 
     let timestamp = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
@@ -250,7 +251,7 @@ pub async fn paste_image_to_terminal(
 
     state
         .exec_manager
-        .write_file_to_container(&container_id, &file_name, &image_data)
+        .write_file_to_container(&target, &file_name, &image_data)
         .await
 }
 
@@ -283,7 +284,7 @@ pub async fn upload_host_file_to_terminal(
     let base = crate::commands::file_commands::host_upload_name(&host_path)?;
     let host_path = crate::commands::file_commands::resolve_host_read_path(&host_path).await?;
 
-    let container_id = state.exec_manager.get_container_id(&session_id).await?;
+    let target = state.exec_manager.get_target(&session_id).await?;
 
     let meta = tokio::fs::metadata(&host_path)
         .await
@@ -313,7 +314,7 @@ pub async fn upload_host_file_to_terminal(
     // with the code that does the reading, which re-applies it to the open
     // descriptor — this check is here only so the refusal reads like a sentence
     // instead of arriving after a 300 MB read.
-    use crate::docker::exec::MAX_DROP_BYTES;
+    use crate::host::MAX_DROP_BYTES;
     if meta.len() > MAX_DROP_BYTES {
         return Err(format!(
             "File too large to drop into the terminal ({:.0} MB; limit {} MB). Mount it into the project instead.",
@@ -326,20 +327,18 @@ pub async fn upload_host_file_to_terminal(
 
     // Ensure the destination directory exists rather than relying on Docker's
     // archive extractor to create the parent for the uploaded tar entry.
-    crate::docker::exec::exec_oneshot(
-        &container_id,
-        vec!["mkdir".to_string(), "-p".to_string(), "/tmp/triple-c-drops".to_string()],
-    )
-    .await?;
+    target
+        .exec_oneshot(vec![
+            "mkdir".to_string(),
+            "-p".to_string(),
+            "/tmp/triple-c-drops".to_string(),
+        ])
+        .await?;
 
     let file_name = format!("triple-c-drops/{}", base);
-    crate::docker::exec::upload_host_file_to_container(
-        &container_id,
-        &host_path,
-        "/tmp",
-        &file_name,
-    )
-    .await
+    target
+        .upload_host_file(&host_path, "/tmp", &file_name)
+        .await
 }
 
 #[tauri::command]
@@ -347,8 +346,8 @@ pub async fn start_audio_bridge(
     session_id: String,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
-    // Get container_id from the terminal session
-    let container_id = state.exec_manager.get_container_id(&session_id).await?;
+    // Get the container from the terminal session
+    let target = state.exec_manager.get_target(&session_id).await?;
 
     // Create audio bridge exec session with ID "audio-{session_id}"
     // The loop handles reconnection when the FIFO reader (fake rec) is killed and restarted
@@ -362,7 +361,7 @@ pub async fn start_audio_bridge(
     state
         .exec_manager
         .create_session_with_tty(
-            &container_id,
+            &target,
             &audio_session_id,
             cmd,
             false,

app/src-tauri/src/container_watch.rs

@@ -8,9 +8,10 @@
 //! disconnected, while the sidebar, Start/Stop and Project Home all still
 //! described a live container.
 //!
-//! One subscription to Docker's event stream, filtered daemon-side to container
-//! `die` events, so an idle daemon costs nothing and the app hears about a death
-//! as it happens. No polling loop. Each `die` naming a project's container is
+//! One subscription to the host's death reports (`host::watch`; for Docker,
+//! the daemon's event stream filtered to container `die` events, so an idle
+//! daemon costs nothing and the app hears about a death as it happens — no
+//! polling loop). Each `die` naming a project's container is
 //! confirmed with one inspect before anything changes (an event can be
 //! replayed, and a restart can reuse the id), and the flip itself is
 //! [`ProjectsStore::mark_exited`]'s compare-and-set, which never touches a
@@ -22,20 +23,18 @@
 //! the only window that replay cannot cover is a daemon restart, which forgets
 //! its event history, and that is exactly when containers go away.
 
-use std::collections::HashMap;
 use std::future::Future;
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
-use bollard::errors::Error as DockerError;
-use bollard::models::{EventMessage, EventMessageTypeEnum};
-use bollard::system::EventsOptions;
-use bollard::Docker;
 use futures_util::StreamExt;
 use serde::Serialize;
 use tauri::{AppHandle, Emitter};
 use tokio::sync::watch;
 
+use crate::aws::tasks::StopKind;
+use crate::host::watch::ExitSource;
+use crate::host::ContainerTarget;
 use crate::models::{Project, ProjectStatus};
 use crate::storage::projects_store::{ExitMark, ProjectsStore};
 
@@ -70,26 +69,31 @@ pub enum ExitReason {
 pub struct ContainerExited<'a> {
     pub project: &'a Project,
     pub reason: ExitReason,
+    /// AWS: why ECS says the task stopped (P8). `None` on Docker, or when
+    /// the watch has no reason on record.
+    pub stop: Option<StopNote>,
 }
 
-/// The container id a Docker event reports as having died, if it is one.
-pub(crate) fn died_container(msg: &EventMessage) -> Option<&str> {
-    if msg.typ != Some(EventMessageTypeEnum::CONTAINER) || msg.action.as_deref() != Some("die") {
-        return None;
-    }
-    msg.actor.as_ref()?.id.as_deref().filter(|id| !id.is_empty())
+/// Why an AWS task stopped, for the UI's toast.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct StopNote {
+    /// `spot`, `idle`, `failed` (the project goes to Error), `user` (someone
+    /// stopped it: no toast) or `exited` (on its own).
+    pub kind: &'static str,
+    /// ECS's stopped reason, or a fixed text.
+    pub message: Option<String>,
 }
 
-/// `true` only when Docker positively says the container is not running: it
-/// inspects as stopped, or it no longer exists. Any other failure is "don't
-/// know" — `docker::is_container_running` maps every error to `false`, which
-/// is right for its callers and wrong here, where it would mark every project
-/// Stopped the moment the daemon hiccups.
-async fn has_exited(docker: &Docker, container_id: &str) -> bool {
-    match docker.inspect_container(container_id, None).await {
-        Ok(info) => !info.state.and_then(|s| s.running).unwrap_or(false),
-        Err(DockerError::DockerResponseServerError { status_code: 404, .. }) => true,
-        Err(_) => false,
+impl StopNote {
+    pub fn of(kind: &StopKind) -> StopNote {
+        let (kind, message) = match kind {
+            StopKind::Spot => ("spot", Some("Spot interruption".to_string())),
+            StopKind::Idle => ("idle", None),
+            StopKind::FailedToStart(r) => ("failed", Some(r.clone())),
+            StopKind::UserInitiated => ("user", None),
+            StopKind::Exited(r) => ("exited", r.clone()),
+        };
+        StopNote { kind, message }
     }
 }
 
@@ -97,21 +101,24 @@ fn project_busy(project_id: &str) -> bool {
     crate::project_lock::held(project_id).is_some()
 }
 
-/// Confirm `container_id` really stopped and, if a project was Running on it,
+/// Confirm `container` really stopped and, if a project was Running on it,
 /// flip that project. Returns what changed.
-async fn settle(docker: &Docker, store: &ProjectsStore, container_id: &str) -> Option<Project> {
+async fn settle(store: &ProjectsStore, container: &ContainerTarget) -> Option<Project> {
+    let container_id = container.id();
     for _ in 0..SETTLE_ATTEMPTS {
         // Cheap and allocation-free: most containers that die are not ours
         // (probe and scratch containers, other software on the daemon), and
         // those cost no inspect at all.
         let seen = store.running_on(container_id)?;
-        if !has_exited(docker, container_id).await {
+        // Positive exit only: a host that can't answer must not mark every
+        // project Stopped.
+        if !container.has_exited().await {
             return None;
         }
         match store.mark_exited(container_id, &seen, project_busy) {
             ExitMark::Flipped(p) => return Some(*p),
             ExitMark::NotApplicable => return None,
-            // The store moved while Docker was answering — possibly a stop and
+            // The store moved while the host was answering — possibly a stop and
             // start of this very container. The inspect is stale; ask again.
             ExitMark::Changed => continue,
         }
@@ -120,27 +127,20 @@ async fn settle(docker: &Docker, store: &ProjectsStore, container_id: &str) -> O
 }
 
 /// Re-check every Running project once. Used on each (re)subscription.
-async fn sweep(docker: &Docker, store: &ProjectsStore) -> Vec<Project> {
+async fn sweep(store: &ProjectsStore) -> Vec<Project> {
     let mut changed = Vec::new();
     for p in store.list() {
         if p.status != ProjectStatus::Running {
             continue;
         }
-        let Some(cid) = p.container_id.as_deref() else { continue };
-        if let Some(c) = settle(docker, store, cid).await {
+        let Some(container) = ContainerTarget::for_project(&p) else { continue };
+        if let Some(c) = settle(store, &container).await {
             changed.push(c);
         }
     }
     changed
 }
 
-fn die_filter() -> HashMap<String, Vec<String>> {
-    HashMap::from([
-        ("type".to_string(), vec!["container".to_string()]),
-        ("event".to_string(), vec!["die".to_string()]),
-    ])
-}
-
 /// The wait before connection attempt `n + 1`, after `n` consecutive
 /// unproductive ones: 5 s, 10 s, 20 s, 40 s, then 60 s for good.
 fn retry_delay(consecutive_failures: u32) -> Duration {
@@ -148,7 +148,7 @@ fn retry_delay(consecutive_failures: u32) -> Duration {
     (RETRY_MIN * 2u32.pow(doublings)).min(RETRY_MAX)
 }
 
-/// `fut`, unless the app starts shutting down first. Every Docker call in here
+/// `fut`, unless the app starts shutting down first. Every host call in here
 /// goes through this: a wedged daemon must not hold shutdown for its full
 /// budget.
 async fn unless_cancelled<T>(
@@ -170,36 +170,30 @@ async fn unless_cancelled<T>(
 /// (see [`STABLE_AFTER`]).
 async fn watch_once(
     store: &ProjectsStore,
+    source: &ExitSource,
     cancel: &mut watch::Receiver<bool>,
     sweep_reason: ExitReason,
     on_change: &impl Fn(&Project, ExitReason),
 ) -> Option<bool> {
-    let Ok(docker) = crate::docker::get_docker() else { return Some(false) };
-    if unless_cancelled(cancel, docker.ping()).await?.is_err() {
+    if !unless_cancelled(cancel, source.reachable()).await? {
         return Some(false);
     }
-    // A second's overlap: the daemon replays from `since`, so a death during
+    // A second's overlap: the host replays from `since`, so a death during
     // the sweep below is still delivered. Duplicates are harmless — `settle`
     // confirms with an inspect every time.
-    let since = (chrono::Utc::now().timestamp() - 1).to_string();
-    for p in unless_cancelled(cancel, sweep(&docker, store)).await? {
+    let since = chrono::Utc::now().timestamp() - 1;
+    for p in unless_cancelled(cancel, sweep(store)).await? {
         on_change(&p, sweep_reason);
     }
-    let mut events = docker.events(Some(EventsOptions::<String> {
-        since: Some(since),
-        until: None,
-        filters: die_filter(),
-    }));
+    let mut deaths = source.deaths(since);
     let connected = Instant::now();
     let mut delivered = false;
     loop {
-        match unless_cancelled(cancel, events.next()).await? {
-            Some(Ok(msg)) => {
+        match unless_cancelled(cancel, deaths.next()).await? {
+            Some(Ok(container)) => {
                 delivered = true;
-                if let Some(cid) = died_container(&msg) {
-                    if let Some(p) = unless_cancelled(cancel, settle(&docker, store, cid)).await? {
-                        on_change(&p, ExitReason::Exited);
-                    }
+                if let Some(p) = unless_cancelled(cancel, settle(store, &container)).await? {
+                    on_change(&p, ExitReason::Exited);
                 }
             }
             Some(Err(e)) => {
@@ -220,6 +214,7 @@ async fn watch_once(
 /// test can drive it without a Tauri app.
 pub(crate) async fn run(
     store: Arc<ProjectsStore>,
+    source: ExitSource,
     mut cancel: watch::Receiver<bool>,
     on_change: impl Fn(&Project, ExitReason),
 ) {
@@ -230,7 +225,7 @@ pub(crate) async fn run(
     let mut sweep_reason = ExitReason::FoundStopped;
     let mut failures: u32 = 0;
     loop {
-        let Some(healthy) = watch_once(&store, &mut cancel, sweep_reason, &on_change).await else {
+        let Some(healthy) = watch_once(&store, &source, &mut cancel, sweep_reason, &on_change).await else {
             return;
         };
         sweep_reason = ExitReason::Exited;
@@ -242,21 +237,59 @@ pub(crate) async fn run(
     }
 }
 
-/// Start the watcher for the life of the app.
+/// Start a watcher on `source` for the life of the app. One per host kind:
+/// Docker's event stream, and (Task 6) the AWS task poll.
 pub fn spawn(
     app: AppHandle,
     store: Arc<ProjectsStore>,
+    source: ExitSource,
     cancel: watch::Receiver<bool>,
 ) -> tauri::async_runtime::JoinHandle<()> {
     tauri::async_runtime::spawn(async move {
-        run(store, cancel, |p, reason| {
+        let store_for_aws = store.clone();
+        run(store, source, cancel, move |p, reason| {
             log::warn!(
                 "Project '{}' ({}): its container stopped without the app asking ({:?}) — marking Stopped",
                 p.name,
                 p.id,
                 reason
             );
-            let _ = app.emit(CONTAINER_EXITED_EVENT, ContainerExited { project: p, reason });
+            // Why ECS stopped it, read before the tunnel (and with it the
+            // registry's record) goes.
+            let kind = p
+                .is_aws()
+                .then(|| p.container_id.as_deref().and_then(crate::host::tunnels::stop_kind))
+                .flatten();
+            let mut shown = p.clone();
+            // A task that never got going is an error, not a stop (P8).
+            if let Some(StopKind::FailedToStart(_)) = kind {
+                if store_for_aws.update_status(&p.id, ProjectStatus::Error).is_ok() {
+                    shown.status = ProjectStatus::Error;
+                }
+            }
+            // An AWS task that stopped: its tunnel leads nowhere now, and its
+            // task ARN is history (the data's access point stays).
+            if p.is_aws() {
+                if let Some(a) = p.aws.as_ref() {
+                    let _ = store_for_aws.set_aws_runtime(
+                        &p.id,
+                        None,
+                        a.access_point_id.clone(),
+                        a.task_definition_arn.clone(),
+                    );
+                }
+                let id = p.id.clone();
+                if let Some(arn) = p.aws.as_ref().and_then(|a| a.task_arn.clone()) {
+                    tauri::async_runtime::spawn(async move {
+                        crate::host::tunnels::close_if_task(&id, &arn).await
+                    });
+                }
+            }
+            if let Some(store_p) = store_for_aws.get(&p.id) {
+                shown = store_p;
+            }
+            let stop = kind.as_ref().map(StopNote::of);
+            let _ = app.emit(CONTAINER_EXITED_EVENT, ContainerExited { project: &shown, reason, stop });
         })
         .await;
     })
@@ -265,41 +298,6 @@ pub fn spawn(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use bollard::models::EventActor;
-
-    fn event(typ: EventMessageTypeEnum, action: &str, id: Option<&str>) -> EventMessage {
-        EventMessage {
-            typ: Some(typ),
-            action: Some(action.to_string()),
-            actor: Some(EventActor { id: id.map(str::to_string), attributes: None }),
-            ..Default::default()
-        }
-    }
-
-    #[test]
-    fn only_a_container_die_names_a_container() {
-        let die = event(EventMessageTypeEnum::CONTAINER, "die", Some("abc"));
-        assert_eq!(died_container(&die), Some("abc"));
-
-        for (typ, action, id) in [
-            (EventMessageTypeEnum::CONTAINER, "stop", Some("abc")),
-            (EventMessageTypeEnum::CONTAINER, "start", Some("abc")),
-            (EventMessageTypeEnum::CONTAINER, "exec_die", Some("abc")),
-            (EventMessageTypeEnum::NETWORK, "die", Some("abc")),
-            (EventMessageTypeEnum::CONTAINER, "die", None),
-            (EventMessageTypeEnum::CONTAINER, "die", Some("")),
-        ] {
-            assert_eq!(died_container(&event(typ, action, id)), None, "{typ:?} {action} {id:?}");
-        }
-    }
-
-    #[test]
-    fn the_subscription_is_filtered_to_container_deaths_daemon_side() {
-        let f = die_filter();
-        assert_eq!(f.get("type"), Some(&vec!["container".to_string()]));
-        assert_eq!(f.get("event"), Some(&vec!["die".to_string()]));
-        assert_eq!(f.len(), 2);
-    }
 
     #[test]
     fn retries_back_off_to_a_minute_and_stay_there() {
@@ -312,16 +310,39 @@ mod tests {
     #[test]
     fn the_event_says_why_so_the_ui_can_tell_news_from_housekeeping() {
         let p = Project::new("demo".to_string(), Vec::new());
-        let v = serde_json::to_value(ContainerExited { project: &p, reason: ExitReason::Exited }).unwrap();
+        let v = serde_json::to_value(ContainerExited { project: &p, reason: ExitReason::Exited, stop: None })
+            .unwrap();
         assert_eq!(v["reason"], "exited");
         assert_eq!(v["project"]["name"], "demo");
-        let v = serde_json::to_value(ContainerExited { project: &p, reason: ExitReason::FoundStopped })
-            .unwrap();
+        assert!(v["stop"].is_null());
+        let v = serde_json::to_value(ContainerExited {
+            project: &p,
+            reason: ExitReason::FoundStopped,
+            stop: Some(StopNote::of(&StopKind::Spot)),
+        })
+        .unwrap();
         assert_eq!(v["reason"], "found_stopped");
+        assert_eq!(v["stop"], serde_json::json!({ "kind": "spot", "message": "Spot interruption" }));
         assert_eq!(CONTAINER_EXITED_EVENT, "project-container-exited");
     }
 
-    /// The shutdown path: a Docker call that never answers (a wedged daemon)
+    #[test]
+    fn every_stop_kind_has_a_note_for_the_ui() {
+        let cases = [
+            (StopKind::Spot, "spot", Some("Spot interruption")),
+            (StopKind::Idle, "idle", None),
+            (StopKind::FailedToStart("CannotPull".into()), "failed", Some("CannotPull")),
+            (StopKind::UserInitiated, "user", None),
+            (StopKind::Exited(Some("OOM".into())), "exited", Some("OOM")),
+            (StopKind::Exited(None), "exited", None),
+        ];
+        for (k, kind, message) in cases {
+            let n = StopNote::of(&k);
+            assert_eq!((n.kind, n.message.as_deref()), (kind, message), "{k:?}");
+        }
+    }
+
+    /// The shutdown path: a host call that never answers (a wedged daemon)
     /// must give way to cancellation at once, not hold teardown.
     #[tokio::test]
     async fn a_hung_docker_call_yields_to_cancellation() {
@@ -338,6 +359,48 @@ mod tests {
         assert_eq!(unless_cancelled(&mut rx, async { 1 }).await, None);
     }
 
+    /// The AWS source drives the same loop: it is "reachable" without a
+    /// ping, polls its lookup every interval, and gives way to cancellation.
+    /// No project is Running, so nothing is confirmed (and nothing reaches
+    /// Docker or AWS).
+    #[tokio::test(start_paused = true)]
+    async fn an_aws_source_polls_its_lookup_until_cancelled() {
+        use crate::host::watch::{AwsTaskLookup, AwsWatch, TaskGroup, WatchedTask};
+        use futures_util::future::BoxFuture;
+        use std::sync::atomic::{AtomicUsize, Ordering};
+
+        struct Lookup(AtomicUsize);
+        impl AwsTaskLookup for Lookup {
+            fn running_tasks(&self) -> Vec<WatchedTask> {
+                self.0.fetch_add(1, Ordering::SeqCst);
+                Vec::new()
+            }
+            fn stopped<'a>(
+                &'a self,
+                _: &'a TaskGroup,
+                _: &'a [String],
+            ) -> BoxFuture<'a, Result<Vec<String>, String>> {
+                Box::pin(async { Ok(Vec::new()) })
+            }
+        }
+
+        let dir = std::env::temp_dir().join(format!("triple-c-watch-aws-{}", uuid::Uuid::new_v4().simple()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let store = Arc::new(ProjectsStore::over_file_for_test(dir.join("projects.json"), Vec::new()));
+        let lookup = Arc::new(Lookup(AtomicUsize::new(0)));
+        let source = ExitSource::Aws(AwsWatch::every(lookup.clone(), Duration::from_secs(15)));
+        let (cancel_tx, cancel_rx) = watch::channel(false);
+        let watcher = tokio::spawn(run(store, source, cancel_rx, |_, _| panic!("nothing stopped")));
+        tokio::time::sleep(Duration::from_secs(46)).await;
+        assert_eq!(lookup.0.load(Ordering::SeqCst), 3);
+        let _ = cancel_tx.send(true);
+        tokio::time::timeout(Duration::from_secs(1), watcher)
+            .await
+            .expect("stops at once")
+            .unwrap();
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
     /// End to end against a real daemon: a Running project whose container is
     /// killed from outside the app is flipped to Stopped and reported as a live
     /// exit; one found already stopped on the first look is reported as such;
@@ -370,7 +433,7 @@ mod tests {
 
         let (cancel_tx, cancel_rx) = watch::channel(false);
         let (seen_tx, mut seen_rx) = tokio::sync::mpsc::unbounded_channel::<(String, ExitReason)>();
-        let watcher = tokio::spawn(run(store.clone(), cancel_rx, move |p, why| {
+        let watcher = tokio::spawn(run(store.clone(), ExitSource::Docker, cancel_rx, move |p, why| {
             let _ = seen_tx.send((p.id.clone(), why));
         }));
         let first = tokio::time::timeout(Duration::from_secs(10), seen_rx.recv()).await;

app/src-tauri/src/docker/client.rs

@@ -26,3 +26,13 @@ pub async fn check_docker_available() -> Result<bool, String> {
         }
     }
 }
+
+/// The daemon socket a project container gets bind-mounted when Docker access
+/// is enabled and no path is configured.
+pub fn default_docker_socket() -> String {
+    if cfg!(target_os = "windows") {
+        "//./pipe/docker_engine".to_string()
+    } else {
+        "/var/run/docker.sock".to_string()
+    }
+}

app/src-tauri/src/docker/container.rs

@@ -9,6 +9,8 @@ use sha2::{Sha256, Digest};
 
 use super::ca_certs;
 use super::client::get_docker;
+use super::workspace_env::{workspace_env, WorkspaceEnvInputs};
+use crate::models::AppSettings;
 use crate::models::{Backend, BedrockAuthMethod, ClaudeCodeSettings, ContainerInfo, EnvVar, GlobalAwsSettings, GlobalLlamaCppSettings, GlobalOllamaSettings, GlobalOpenAiCompatibleSettings, PortMapping, Project, ProjectPath};
 
 const SCHEDULER_INSTRUCTIONS: &str = r#"## Scheduled Tasks
@@ -138,7 +140,7 @@ The user can click a file path in this terminal to open it in a viewer (while a
 /// instructions, appending port mapping docs, and appending scheduler docs.
 /// Used by both create_container() and container_needs_recreation() to ensure
 /// the same value is produced in both paths.
-fn build_claude_instructions(
+pub(super) fn build_claude_instructions(
     global_instructions: Option<&str>,
     project_instructions: Option<&str>,
     port_mappings: &[PortMapping],
@@ -243,7 +245,11 @@ pub(crate) const LABEL_SCRUB: &str = "triple-c.scrub";
 /// cannot travel onto a snapshot. See the `LABEL` block in the Dockerfile.
 pub(crate) const LABEL_BASE: &str = "triple-c.base";
 
-const RESERVED_ENV_PREFIXES: &[&str] = &["ANTHROPIC_", "AWS_", "GIT_", "HOST_", "TRIPLE_C_"];
+/// `TRIPLEC_` is the AWS workspace's own namespace (`TRIPLEC_HOST`,
+/// `TRIPLEC_FILES`, `TRIPLEC_AGENT_TOKEN`, … — see `container/entrypoint.sh`):
+/// a custom var there could switch a local container into AWS mode or forge
+/// the inputs the entrypoint trusts.
+const RESERVED_ENV_PREFIXES: &[&str] = &["ANTHROPIC_", "AWS_", "GIT_", "HOST_", "TRIPLE_C_", "TRIPLEC_"];
 
 /// Exact env var names Triple-C manages itself. Not covered by
 /// [`RESERVED_ENV_PREFIXES`] because they don't share those prefixes.
@@ -355,7 +361,7 @@ fn model_alias_fingerprint_part(
 }
 
 /// Whether `key` is an env var name Triple-C reserves for itself.
-fn is_reserved_env_key(key: &str) -> bool {
+pub(super) fn is_reserved_env_key(key: &str) -> bool {
     let upper = key.to_uppercase();
     RESERVED_ENV_PREFIXES.iter().any(|p| upper.starts_with(p))
         || RESERVED_ENV_EXACT.iter().any(|e| upper == *e)
@@ -374,7 +380,7 @@ fn is_reserved_env_key(key: &str) -> bool {
 ///
 /// Empty stays empty rather than becoming the hash of the empty string: an empty
 /// label is how every other `triple-c.*` key says "nothing configured".
-fn compute_env_fingerprint(custom_env_vars: &[EnvVar]) -> String {
+pub(super) fn compute_env_fingerprint(custom_env_vars: &[EnvVar]) -> String {
     let mut parts: Vec<String> = Vec::new();
     for env_var in custom_env_vars {
         let key = env_var.key.trim();
@@ -400,7 +406,7 @@ fn compute_env_fingerprint(custom_env_vars: &[EnvVar]) -> String {
 ///
 /// The returned token is never logged and never leaves this module except as
 /// the env var value handed to Docker.
-fn shared_claude_auth(project: &Project) -> Option<(String, String)> {
+pub(super) fn shared_claude_auth(project: &Project) -> Option<(String, String)> {
     if project.backend != Backend::Anthropic || !project.use_shared_auth_token {
         return None;
     }
@@ -431,7 +437,7 @@ fn claude_token_label(project: &Project) -> String {
 
 /// Merge global and per-project custom environment variables.
 /// Per-project variables override global variables with the same key.
-fn merge_custom_env_vars(global: &[EnvVar], project: &[EnvVar]) -> Vec<EnvVar> {
+pub(super) fn merge_custom_env_vars(global: &[EnvVar], project: &[EnvVar]) -> Vec<EnvVar> {
     let mut merged: std::collections::HashMap<String, EnvVar> = std::collections::HashMap::new();
     for ev in global {
         let key = ev.key.trim().to_string();
@@ -493,7 +499,7 @@ fn sha256_hex(input: &str) -> String {
 
 /// Resolve a per-project string value with a global fallback. Returns `None`
 /// when both are blank, otherwise the per-project value if set, else the global.
-fn resolve_with_global<'a>(per_project: Option<&'a str>, global: Option<&'a str>) -> Option<&'a str> {
+pub(super) fn resolve_with_global<'a>(per_project: Option<&'a str>, global: Option<&'a str>) -> Option<&'a str> {
     let project_val = per_project.map(str::trim).filter(|s| !s.is_empty());
     if project_val.is_some() {
         return project_val;
@@ -658,7 +664,7 @@ fn compute_ports_fingerprint(port_mappings: &[PortMapping]) -> String {
 /// to the global set and never turn a globally-enabled setting off. `None` at
 /// project level means "inherit", which is now a state the project can
 /// actually be in rather than the only state an off switch could produce.
-fn merge_claude_code_settings(
+pub(super) fn merge_claude_code_settings(
     global: Option<&ClaudeCodeSettings>,
     project: Option<&ClaudeCodeSettings>,
 ) -> Option<ClaudeCodeSettings> {
@@ -758,7 +764,7 @@ fn compute_claude_code_settings_fingerprint(
 ///
 /// The other two are documented as "set to `1` to …" with no meaning attached
 /// to `0`, so `0` is unambiguously neutral and is stated outright.
-fn claude_code_env_vars(settings: Option<&ClaudeCodeSettings>) -> Vec<String> {
+pub(super) fn claude_code_env_vars(settings: Option<&ClaudeCodeSettings>) -> Vec<String> {
     let owned;
     let s = match settings {
         Some(s) => s,
@@ -821,7 +827,7 @@ fn claude_code_env_vars(settings: Option<&ClaudeCodeSettings>) -> Vec<String> {
 ///
 /// Returns a `String` rather than an `Option<String>`: there is no longer any
 /// input for which this produces nothing to say.
-fn build_claude_code_settings_json(
+pub(super) fn build_claude_code_settings_json(
     settings: Option<&ClaudeCodeSettings>,
     sandbox_enabled: bool,
 ) -> String {
@@ -1079,7 +1085,7 @@ type VpnHostConfigParts = (
 /// `MISSION_CONTROL_ENABLED` twenty lines above shows the failure this avoids —
 /// it is pushed only when true, so a snapshot's baked `=1` survives the toggle
 /// going off.
-fn vpn_env_var(enabled: bool) -> String {
+pub(super) fn vpn_env_var(enabled: bool) -> String {
     format!("VPN_SUPPORT_ENABLED={}", u8::from(enabled))
 }
 
@@ -1265,212 +1271,24 @@ pub async fn create_container(
         log::debug!("Skipping HOST_UID/HOST_GID on Windows — Docker Desktop's Linux VM handles user mapping");
     }
 
-    if let Some(ref token) = project.git_token {
-        env_vars.push(format!("GIT_TOKEN={}", token));
-    }
-    // Per-project git user overrides global defaults
-    let effective_git_name = project.git_user_name.as_deref().or(default_git_user_name);
-    let effective_git_email = project.git_user_email.as_deref().or(default_git_user_email);
-    if let Some(name) = effective_git_name {
-        env_vars.push(format!("GIT_USER_NAME={}", name));
-    }
-    if let Some(email) = effective_git_email {
-        env_vars.push(format!("GIT_USER_EMAIL={}", email));
-    }
-
-    // Bedrock configuration
-    if project.backend == Backend::Bedrock {
-        if let Some(ref bedrock) = project.bedrock_config {
-            env_vars.push("CLAUDE_CODE_USE_BEDROCK=1".to_string());
-
-            // AWS region: per-project overrides global
-            let region = if !bedrock.aws_region.is_empty() {
-                Some(bedrock.aws_region.clone())
-            } else {
-                global_aws.aws_region.clone()
-            };
-            if let Some(ref r) = region {
-                env_vars.push(format!("AWS_REGION={}", r));
-            }
-
-            match bedrock.auth_method {
-                BedrockAuthMethod::StaticCredentials => {
-                    // Static/session credentials are NOT injected as env vars.
-                    // They are written to ~/.aws/credentials by
-                    // sync_bedrock_credentials() on every container
-                    // start, so rotated/updated keys are picked up without a
-                    // full container recreation (and never get baked into the
-                    // snapshot image). The empty values set by the
-                    // MANAGED_AUTH_KEYS neutralization pass below are ignored by
-                    // the AWS SDK, which falls through to the credentials file.
-                }
-                BedrockAuthMethod::Profile => {
-                    // Per-project profile overrides global
-                    let profile = bedrock.aws_profile.as_ref()
-                        .or(global_aws.aws_profile.as_ref());
-                    if let Some(p) = profile {
-                        env_vars.push(format!("AWS_PROFILE={}", p));
-                    }
-                    env_vars.push("AWS_SSO_AUTH_REFRESH_CMD=triple-c-sso-refresh".to_string());
-                }
-                BedrockAuthMethod::BearerToken => {
-                    if let Some(ref token) = bedrock.aws_bearer_token {
-                        env_vars.push(format!("AWS_BEARER_TOKEN_BEDROCK={}", token));
-                    }
-                }
-            }
-
-            if let Some(model) = resolve_with_global(
-                bedrock.model_id.as_deref(),
-                global_aws.default_model_id.as_deref(),
-            ) {
-                env_vars.push(format!("ANTHROPIC_MODEL={}", model));
-            }
-
-            if bedrock.disable_prompt_caching {
-                env_vars.push("DISABLE_PROMPT_CACHING=1".to_string());
-            }
-
-            if let Some(ref tier) = bedrock.service_tier {
-                let trimmed = tier.trim();
-                if !trimmed.is_empty() {
-                    env_vars.push(format!("ANTHROPIC_BEDROCK_SERVICE_TIER={}", trimmed));
-                }
-            }
-        }
-    }
-
-    // ── Custom-endpoint backends ─────────────────────────────────────────────
-    // Ollama, llama.cpp and the OpenAI-Compatible gateway all point Claude Code
-    // at a non-Anthropic server via ANTHROPIC_BASE_URL. Each resolves its model
-    // id here; the model-alias vars are emitted once below, from
-    // `alias_model` / `alias_haiku`, so the three backends cannot drift apart.
-    let mut alias_model: Option<String> = None;
-    let mut alias_haiku: Option<String> = None;
-
-    // Ollama configuration
-    if project.backend == Backend::Ollama {
-        if let Some(ref ollama) = project.ollama_config {
-            if let Some(url) = resolve_with_global(
-                Some(&ollama.base_url),
-                global_ollama.base_url.as_deref(),
-            ) {
-                env_vars.push(format!("ANTHROPIC_BASE_URL={}", url));
-            }
-            env_vars.push("ANTHROPIC_AUTH_TOKEN=ollama".to_string());
-            if let Some(model) = resolve_with_global(
-                ollama.model_id.as_deref(),
-                global_ollama.default_model_id.as_deref(),
-            ) {
-                env_vars.push(format!("ANTHROPIC_MODEL={}", model));
-                alias_model = Some(model.to_string());
-            }
-            alias_haiku = resolve_with_global(
-                ollama.haiku_model_id.as_deref(),
-                global_ollama.default_haiku_model_id.as_deref(),
-            )
-            .map(str::to_string);
-        }
-    }
-
-    // llama.cpp (llama-server) configuration
-    if project.backend == Backend::LlamaCpp {
-        if let Some(ref cfg) = project.llamacpp_config {
-            if let Some(url) = resolve_with_global(
-                Some(&cfg.base_url),
-                global_llamacpp.base_url.as_deref(),
-            ) {
-                env_vars.push(format!("ANTHROPIC_BASE_URL={}", url));
-            }
-            // llama-server only enforces an Authorization header when it was
-            // started with `--api-key` (default: none), so the value here is
-            // ignored in the common case. Claude Code still refuses to run
-            // against a custom base URL with no credential at all, so a
-            // placeholder is always sent — same trick as the Ollama branch
-            // above, which sends the literal "ollama".
-            env_vars.push("ANTHROPIC_AUTH_TOKEN=llama.cpp".to_string());
-            if let Some(model) = resolve_with_global(
-                cfg.model_id.as_deref(),
-                global_llamacpp.default_model_id.as_deref(),
-            ) {
-                env_vars.push(format!("ANTHROPIC_MODEL={}", model));
-                alias_model = Some(model.to_string());
-            }
-            alias_haiku = resolve_with_global(
-                cfg.haiku_model_id.as_deref(),
-                global_llamacpp.default_haiku_model_id.as_deref(),
-            )
-            .map(str::to_string);
-        }
-    }
-
-    // OpenAI Compatible configuration
-    if project.backend == Backend::OpenAiCompatible {
-        if let Some(ref config) = project.openai_compatible_config {
-            if let Some(url) = resolve_with_global(
-                Some(&config.base_url),
-                global_openai_compatible.base_url.as_deref(),
-            ) {
-                env_vars.push(format!("ANTHROPIC_BASE_URL={}", url));
-            }
-            if let Some(ref key) = config.api_key {
-                env_vars.push(format!("ANTHROPIC_AUTH_TOKEN={}", key));
-            }
-            if let Some(model) = resolve_with_global(
-                config.model_id.as_deref(),
-                global_openai_compatible.default_model_id.as_deref(),
-            ) {
-                env_vars.push(format!("ANTHROPIC_MODEL={}", model));
-                alias_model = Some(model.to_string());
-            }
-            alias_haiku = resolve_with_global(
-                config.haiku_model_id.as_deref(),
-                global_openai_compatible.default_haiku_model_id.as_deref(),
-            )
-            .map(str::to_string);
-        }
-    }
-
-    // Model aliases — the fix for background Claude Code calls against a local
-    // server. Only for backends that talk to a custom endpoint: Anthropic and
-    // Bedrock reach servers that really do host the Anthropic model ids, so
-    // they keep Claude Code's own defaults. Anything not emitted here is
-    // blanked by the MANAGED_AUTH_KEYS pass below, so switching *away* from a
-    // custom endpoint clears the aliases out of the snapshot image too.
-    if project.backend.uses_custom_endpoint() {
-        for (key, value) in
-            compute_model_aliases(alias_model.as_deref(), alias_haiku.as_deref())
-        {
-            env_vars.push(format!("{}={}", key, value));
-        }
-    }
-
     // Shared Claude Code OAuth token (Anthropic backend only, opt-out per
-    // project). Injected *before* the neutralization pass below so that pass
-    // sees it as already-set; when it is absent the pass actively blanks the
-    // variable instead of leaving a stale one baked into the snapshot image.
+    // project). Read here — it lives in the keychain — and handed to
+    // `workspace_env`, which injects it before the neutralization pass.
     let shared_claude = shared_claude_auth(project);
-    if let Some((ref token, _)) = shared_claude {
-        env_vars.push(format!("{}={}", CLAUDE_OAUTH_TOKEN_ENV, token));
+    if shared_claude.is_some() {
         log::info!(
             "Injecting the shared Claude authentication token into the container for project {}",
             project.id
         );
     }
 
-    // ── Corporate CA certificates ───────────────────────────────────────────
-    // Resolved here (rather than down with the mounts) so the env vars land
-    // *before* the neutralization pass below and are seen as already-set.
+    // Corporate CA certificates, resolved here (not in `workspace_env`) because
+    // the mount below needs the same resolution.
     //
     // A bad path is a hard error, not a warning: behind a TLS-terminating
     // proxy a container without the CA fails every HTTPS call — npm, pip, git,
     // and Claude Code's own API requests — each in its own confusing way. One
     // message naming the path is far kinder.
-    //
-    // The values are set here rather than exported by the entrypoint because a
-    // terminal session is a `docker exec`, which sees the container's
-    // configured env and nothing the entrypoint exported. Same lesson as
-    // `$BROWSER` and the URL relay shim.
     let effective_ca_path =
         resolve_with_global(project.ca_cert_path.as_deref(), default_ca_cert_path);
     let resolved_ca = ca_certs::resolve(effective_ca_path)?;
@@ -1482,110 +1300,40 @@ pub async fn create_container(
             project.id
         );
     }
-    for (key, value) in ca_certs::ca_env_vars(resolved_ca.as_ref()) {
-        env_vars.push(format!("{}={}", key, value));
-    }
 
-    // ── Neutralize stale backend auth env vars ──────────────────────────────
-    // When a project switches backends (e.g. Bedrock → Anthropic) the container
-    // is recreated *from a snapshot image* committed off the previous container,
-    // and `docker commit` copies that container's full ENV into the image. So
-    // any auth var set under the old backend (e.g. CLAUDE_CODE_USE_BEDROCK=1,
-    // AWS_PROFILE, a model alias) survives in the image ENV and stays active
-    // unless we explicitly override it at create time.
-    //
-    // This pass is about *staleness*, not secrecy. It fixes the container it is
-    // building and does nothing to the image, so it is not — and never was —
-    // a defence against a credential baked into a snapshot. That is
-    // `commit_container_snapshot`'s job, via SECRET_ENV_KEYS.
-    // Create-time env takes precedence over image ENV, so we set every managed
-    // auth key the *current* backend did NOT set to an empty value, clearing the
-    // stale baked-in one.
-    const MANAGED_AUTH_KEYS: &[&str] = &[
-        "CLAUDE_CODE_USE_BEDROCK",
-        "AWS_REGION",
-        "AWS_ACCESS_KEY_ID",
-        "AWS_SECRET_ACCESS_KEY",
-        "AWS_SESSION_TOKEN",
-        "AWS_PROFILE",
-        "AWS_BEARER_TOKEN_BEDROCK",
-        "AWS_SSO_AUTH_REFRESH_CMD",
-        "ANTHROPIC_BASE_URL",
-        "ANTHROPIC_AUTH_TOKEN",
-        "ANTHROPIC_MODEL",
-        "DISABLE_PROMPT_CACHING",
-        "ANTHROPIC_BEDROCK_SERVICE_TIER",
-        // Switching from a custom-endpoint backend to Anthropic or Bedrock must
-        // *clear* the aliases, not merely stop setting them: a stale
-        // ANTHROPIC_DEFAULT_HAIKU_MODEL baked into the snapshot image would
-        // keep pointing background calls at a model id the new backend has
-        // never heard of.
-        ANTHROPIC_DEFAULT_OPUS_MODEL,
-        ANTHROPIC_DEFAULT_SONNET_MODEL,
-        ANTHROPIC_DEFAULT_HAIKU_MODEL,
-        ANTHROPIC_DEFAULT_FABLE_MODEL,
-        // Revoking the shared token, opting a project out, or switching away
-        // from the Anthropic backend must *clear* this, not merely stop setting
-        // it — otherwise the value committed into the snapshot image keeps
-        // authenticating the container with a credential the user removed.
-        CLAUDE_OAUTH_TOKEN_ENV,
-    ];
-    // Same reasoning for the CA vars — `ca_env_vars` already emits them empty
-    // when no CA is configured, so this list is belt-and-braces for a snapshot
-    // committed by a build that predates the feature.
-    let managed_keys: Vec<&str> = MANAGED_AUTH_KEYS
-        .iter()
-        .copied()
-        .chain(ca_certs::CA_ENV_KEYS.iter().copied())
-        .collect();
-    let already_set: std::collections::HashSet<String> = env_vars
-        .iter()
-        .filter_map(|e| e.split('=').next().map(|k| k.to_string()))
-        .collect();
-    for key in &managed_keys {
-        if !already_set.contains(*key) {
-            env_vars.push(format!("{}=", key));
-        }
-    }
+    // Everything project-shaped (backend auth, CA vars, custom env, instructions,
+    // Claude Code settings, ...) comes from the one host-neutral builder, so the
+    // AWS host can put the same pairs in its secret.
+    env_vars.extend(
+        workspace_env(
+            project,
+            &WorkspaceEnvInputs {
+                global_aws,
+                global_ollama,
+                global_llamacpp,
+                global_openai_compatible,
+                global_claude_instructions,
+                global_custom_env_vars,
+                timezone,
+                global_claude_code_settings,
+                default_git_user_name,
+                default_git_user_email,
+                resolved_ca: resolved_ca.as_ref(),
+                shared_claude_token: shared_claude.as_ref().map(|(token, _)| token.as_str()),
+            },
+        )
+        .into_iter()
+        .map(|(key, value)| format!("{}={}", key, value)),
+    );
 
-    // Custom environment variables (global + per-project, project overrides global for same key)
-    let merged_env = merge_custom_env_vars(global_custom_env_vars, &project.custom_env_vars);
-    for env_var in &merged_env {
-        let key = env_var.key.trim();
-        if key.is_empty() {
-            continue;
-        }
-        if is_reserved_env_key(key) {
-            log::warn!("Skipping reserved env var: {}", key);
-            continue;
-        }
-        env_vars.push(format!("{}={}", key, env_var.value));
-    }
-    let custom_env_fingerprint = compute_env_fingerprint(&merged_env);
-    env_vars.push(format!("TRIPLE_C_CUSTOM_ENV={}", custom_env_fingerprint));
-
-    // Container timezone
-    if let Some(tz) = timezone {
-        if !tz.is_empty() {
-            env_vars.push(format!("TZ={}", tz));
-        }
-    }
-
-    // Mission Control env var
-    if project.mission_control_enabled {
-        env_vars.push("MISSION_CONTROL_ENABLED=1".to_string());
-    }
-
-    env_vars.push(vpn_env_var(project.vpn_support_enabled));
-
-    // Permission mode — read by triple-c-task-runner for scheduled (headless)
-    // Claude Code runs. Interactive terminals get the flags directly instead.
-    env_vars.push(format!(
-        "TRIPLE_C_PERMISSION_MODE={}",
-        project.effective_permission_mode().as_env_value()
+    // The labels below fingerprint the inputs that went into the env; derive
+    // them with the same helpers `workspace_env` used, so both always agree.
+    let effective_git_name = project.git_user_name.as_deref().or(default_git_user_name);
+    let effective_git_email = project.git_user_email.as_deref().or(default_git_user_email);
+    let custom_env_fingerprint = compute_env_fingerprint(&merge_custom_env_vars(
+        global_custom_env_vars,
+        &project.custom_env_vars,
     ));
-
-    // Claude instructions (global + per-project, plus port mapping info + scheduler docs)
     let combined_instructions = build_claude_instructions(
         global_claude_instructions,
         project.claude_instructions.as_deref(),
@@ -1593,34 +1341,10 @@ pub async fn create_container(
         project.mission_control_enabled,
         project.sandbox_mode_enabled,
     );
-
-    if let Some(ref instructions) = combined_instructions {
-        env_vars.push(format!("CLAUDE_INSTRUCTIONS={}", instructions));
-    }
-
-    // Claude Code settings (global + per-project merged)
     let merged_cc_settings = merge_claude_code_settings(
         global_claude_code_settings,
         project.claude_code_settings.as_ref(),
     );
-    // Env-var-based settings, read directly by Claude Code. Extracted and unit
-    // tested for the `vpn_host_config` reason: a container is created once, by
-    // a very long function, and a variable emitted with the wrong value here is
-    // invisible until someone wonders why a switch does nothing.
-    env_vars.extend(claude_code_env_vars(merged_cc_settings.as_ref()));
-
-    // settings.json-based settings (applied by the entrypoint). Always emitted,
-    // even with no `ClaudeCodeSettings` struct present: the payload asserts the
-    // *whole* managed key set, so "no settings" still has to be stated over a
-    // settings.json left behind on the config volume by a previous config.
-    // Split so the payload is safe under an older entrypoint that has never
-    // heard of the null-means-delete convention — see
-    // `split_claude_code_settings_payload`.
-    let (cc_settings_set, cc_settings_clear) = split_claude_code_settings_payload(
-        &build_claude_code_settings_json(merged_cc_settings.as_ref(), project.sandbox_mode_enabled),
-    );
-    env_vars.push(format!("CLAUDE_CODE_SETTINGS_JSON={}", cc_settings_set));
-    env_vars.push(format!("CLAUDE_CODE_SETTINGS_CLEAR={}", cc_settings_clear));
 
     let mut mounts: Vec<Mount> = Vec::new();
 
@@ -2015,7 +1739,7 @@ pub const CONFIG_VOLUME_PREFIX: &str = "triple-c-claude-config-";
 /// `aws_config_path` is configured), since the entrypoint already refreshes
 /// `~/.aws` from the host on every start in that case.
 pub async fn sync_bedrock_credentials(
-    container_id: &str,
+    target: &crate::host::ContainerTarget,
     project: &Project,
 ) -> Result<(), String> {
     let static_bedrock = if project.backend == Backend::Bedrock {
@@ -2038,10 +1762,10 @@ pub async fn sync_bedrock_credentials(
             let script = r#"if [ ! -d /tmp/.host-aws ]; then rm -f "$HOME/.aws/credentials"; fi"#;
             let cmd = vec!["sh".to_string(), "-c".to_string(), script.to_string()];
             let env = vec!["HOME=/home/claude".to_string()];
-            if let Err(e) = crate::docker::exec::exec_oneshot_env(container_id, cmd, env).await {
+            if let Err(e) = target.exec_oneshot_env(cmd, env).await {
                 log::warn!(
                     "Failed to clear stale AWS credentials in container {}: {}",
-                    container_id,
+                    target.id(),
                     e
                 );
             }
@@ -2093,7 +1817,7 @@ chmod 600 "$HOME/.aws/credentials""#;
 
     let cmd = vec!["sh".to_string(), "-c".to_string(), script.to_string()];
     let (output, exit_code) =
-        crate::docker::exec::exec_oneshot_env_status(container_id, cmd, env)
+        target.exec_oneshot_env_status(cmd, env)
             .await
             .map_err(|e| format!("Failed to write AWS credentials into container: {}", e))?;
     if exit_code != 0 {
@@ -2104,7 +1828,7 @@ chmod 600 "$HOME/.aws/credentials""#;
         ));
     }
 
-    log::info!("Wrote Bedrock static credentials into container {}", container_id);
+    log::info!("Wrote Bedrock static credentials into container {}", target.id());
     Ok(())
 }
 
@@ -4143,6 +3867,49 @@ pub async fn is_container_running(container_id: &str) -> Result<bool, String> {
 }
 
 
+
+/// Create the project's container, threading every global setting through.
+///
+/// Exists so that the ordinary create paths (`host::lifecycle`) and base-image migration
+/// cannot drift apart — a container created by a migration must be
+/// indistinguishable from one created by a normal start, or the next
+/// `container_needs_recreation` would immediately throw it away.
+///
+/// `create_image` is what to create *from* (the snapshot or the base);
+/// `base_image_name` is the configured base, which `create_container` needs in
+/// order to tell those two apart when it stamps the lineage labels.
+pub async fn create_container_for_project(
+    project: &Project,
+    settings: &AppSettings,
+    docker_socket: &str,
+    aws_config_path: Option<&str>,
+    create_image: &str,
+    base_image_name: &str,
+    extras: CreateExtras<'_>,
+) -> Result<String, String> {
+    create_container(
+        project,
+        docker_socket,
+        create_image,
+        base_image_name,
+        extras,
+        aws_config_path,
+        &settings.global_aws,
+        &settings.global_ollama,
+        &settings.global_llamacpp,
+        &settings.global_openai_compatible,
+        settings.global_claude_instructions.as_deref(),
+        &settings.global_custom_env_vars,
+        settings.timezone.as_deref(),
+        settings.global_claude_code_settings.as_ref(),
+        settings.default_ssh_key_path.as_deref(),
+        settings.ca_cert_path.as_deref(),
+        settings.default_git_user_name.as_deref(),
+        settings.default_git_user_email.as_deref(),
+    )
+    .await
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -4333,6 +4100,22 @@ mod tests {
         assert_eq!(vpn_env_var(false), "VPN_SUPPORT_ENABLED=0");
     }
 
+    #[test]
+    fn the_aws_workspace_namespace_is_reserved_from_custom_env() {
+        for key in ["TRIPLEC_HOST", "TRIPLEC_FILES", "TRIPLEC_AGENT_TOKEN", "triplec_repos", "TRIPLEC_ANYTHING"] {
+            assert!(is_reserved_env_key(key), "{key}");
+        }
+        assert_eq!(
+            compute_env_fingerprint(&[EnvVar {
+                key: "TRIPLEC_HOST".to_string(),
+                value: "aws".to_string(),
+            }]),
+            "",
+            "a reserved key never reaches the container"
+        );
+        assert!(!is_reserved_env_key("TRIPLECX"));
+    }
+
     #[test]
     fn the_vpn_skill_flag_is_reserved_from_custom_env() {
         // entrypoint.sh installs and removes the pia-vpn skill from this

app/src-tauri/src/docker/events.rs

@@ -0,0 +1,114 @@
+//! The Docker half of `container_watch`: reachability, the daemon's container
+//! `die` event stream, and the "has it positively exited" check. Everything
+//! about *what to do* with a death (confirm, compare-and-set the store, tell
+//! the frontend, back off) is host-neutral and stays in `container_watch.rs`,
+//! which reaches these through `host::watch`.
+
+use std::collections::HashMap;
+use std::pin::Pin;
+
+use bollard::errors::Error as DockerError;
+use bollard::models::{EventMessage, EventMessageTypeEnum};
+use bollard::system::EventsOptions;
+use futures_util::{Stream, StreamExt};
+
+use super::client::get_docker;
+
+/// Whether the daemon answers at all.
+pub async fn ping() -> bool {
+    match get_docker() {
+        Ok(docker) => docker.ping().await.is_ok(),
+        Err(_) => false,
+    }
+}
+
+/// The container id a Docker event reports as having died, if it is one.
+pub(crate) fn died_container(msg: &EventMessage) -> Option<&str> {
+    if msg.typ != Some(EventMessageTypeEnum::CONTAINER) || msg.action.as_deref() != Some("die") {
+        return None;
+    }
+    msg.actor.as_ref()?.id.as_deref().filter(|id| !id.is_empty())
+}
+
+fn die_filter() -> HashMap<String, Vec<String>> {
+    HashMap::from([
+        ("type".to_string(), vec!["container".to_string()]),
+        ("event".to_string(), vec!["die".to_string()]),
+    ])
+}
+
+/// Container ids as Docker reports them dying, replayed from `since` (unix
+/// seconds). Filtered daemon-side to container `die` events, so an idle daemon
+/// costs nothing. Anything else that comes through is dropped here. An `Err`
+/// item, or the stream ending, means the connection is gone.
+pub fn container_deaths(since: i64) -> Pin<Box<dyn Stream<Item = Result<String, String>> + Send>> {
+    let docker = match get_docker() {
+        Ok(d) => d,
+        Err(e) => return Box::pin(futures_util::stream::once(async move { Err(e) })),
+    };
+    let events = docker.events(Some(EventsOptions::<String> {
+        since: Some(since.to_string()),
+        until: None,
+        filters: die_filter(),
+    }));
+    Box::pin(events.filter_map(|item| async move {
+        match item {
+            Ok(msg) => died_container(&msg).map(|id| Ok(id.to_string())),
+            Err(e) => Some(Err(e.to_string())),
+        }
+    }))
+}
+
+/// `true` only when Docker positively says the container is not running: it
+/// inspects as stopped, or it no longer exists. Any other failure is "don't
+/// know" — `is_container_running` maps every error to `false`, which is right
+/// for its callers and wrong for the watcher, where it would mark every project
+/// Stopped the moment the daemon hiccups.
+pub async fn has_exited(container_id: &str) -> bool {
+    let Ok(docker) = get_docker() else { return false };
+    match docker.inspect_container(container_id, None).await {
+        Ok(info) => !info.state.and_then(|s| s.running).unwrap_or(false),
+        Err(DockerError::DockerResponseServerError { status_code: 404, .. }) => true,
+        Err(_) => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use bollard::models::EventActor;
+
+    fn event(typ: EventMessageTypeEnum, action: &str, id: Option<&str>) -> EventMessage {
+        EventMessage {
+            typ: Some(typ),
+            action: Some(action.to_string()),
+            actor: Some(EventActor { id: id.map(str::to_string), attributes: None }),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn only_a_container_die_names_a_container() {
+        let die = event(EventMessageTypeEnum::CONTAINER, "die", Some("abc"));
+        assert_eq!(died_container(&die), Some("abc"));
+
+        for (typ, action, id) in [
+            (EventMessageTypeEnum::CONTAINER, "stop", Some("abc")),
+            (EventMessageTypeEnum::CONTAINER, "start", Some("abc")),
+            (EventMessageTypeEnum::CONTAINER, "exec_die", Some("abc")),
+            (EventMessageTypeEnum::NETWORK, "die", Some("abc")),
+            (EventMessageTypeEnum::CONTAINER, "die", None),
+            (EventMessageTypeEnum::CONTAINER, "die", Some("")),
+        ] {
+            assert_eq!(died_container(&event(typ, action, id)), None, "{typ:?} {action} {id:?}");
+        }
+    }
+
+    #[test]
+    fn the_subscription_is_filtered_to_container_deaths_daemon_side() {
+        let f = die_filter();
+        assert_eq!(f.get("type"), Some(&vec!["container".to_string()]));
+        assert_eq!(f.get("event"), Some(&vec!["die".to_string()]));
+        assert_eq!(f.len(), 2);
+    }
+}

app/src-tauri/src/docker/exec.rs

@@ -1,58 +1,44 @@
 use bollard::container::{LogOutput, UploadToContainerOptions};
 use bollard::exec::{CreateExecOptions, ResizeExecOptions, StartExecResults};
-use futures_util::{Stream, StreamExt};
-use std::collections::HashMap;
-use std::pin::Pin;
-use std::sync::Arc;
-use tokio::io::{AsyncWrite, AsyncWriteExt};
-use tokio::sync::{mpsc, Mutex};
+use futures_util::StreamExt;
 
 use super::client::get_docker;
+use crate::host::{ExecChunk, ExecSpec};
 
-/// A `docker exec` that has been created and started with stdin/stdout/stderr
-/// attached — the raw duplex halves, before any policy about what to do with
-/// them.
-///
-/// This is the single place in the codebase that knows how to open an attached
-/// exec. Both consumers are built on it:
-///   * [`ExecSessionManager`] — interactive terminals and the audio bridge,
-///     which pump bytes through mpsc channels and a callback.
-///   * `auth_bridge` — per-connection `socat` tunnels, which pump bytes
-///     straight between a host TCP socket and these halves.
-///
-/// With `tty = false` the output stream is demultiplexed by Docker, so the
-/// consumer can tell [`LogOutput::StdOut`] from [`LogOutput::StdErr`]. That
-/// distinction matters for the auth bridge: `socat`'s diagnostics must not be
-/// spliced into the proxied byte stream.
-pub struct AttachedExec {
-    pub exec_id: String,
-    pub output: Pin<Box<dyn Stream<Item = Result<LogOutput, bollard::errors::Error>> + Send>>,
-    pub input: Pin<Box<dyn AsyncWrite + Send>>,
-}
+// `AttachedExec` lives in `host` now (host-neutral output chunks); this
+// module's job is to produce one from Docker. Its consumers are
+// `host::sessions::ExecSessionManager` (terminals, audio bridge) and the auth
+// bridge's per-connection `socat` tunnels, both through `host::ContainerTarget`.
+// With `tty = false` Docker demultiplexes stdout from stderr, which the auth
+// bridge relies on: `socat`'s diagnostics must not be spliced into the proxied
+// byte stream.
+pub use crate::host::AttachedExec;
 
-/// Create and start an exec with stdin + stdout + stderr attached, returning the
-/// raw duplex halves. Runs as `claude` in `/workspace`, like every other exec
-/// this app opens.
-pub async fn create_attached_exec(
-    container_id: &str,
-    cmd: Vec<String>,
-    tty: bool,
-) -> Result<AttachedExec, String> {
-    create_attached_exec_as(container_id, cmd, tty, "claude", "/workspace").await
-}
-
-/// [`create_attached_exec`] with the user and working directory spelled out.
+/// An attached exec with the user and working directory spelled out.
 ///
-/// Only base-image migration needs this: replaying `apt` and unpacking a
-/// payload tar at `/` have to run as **root**, and every other caller wants the
-/// `claude` / `/workspace` defaults that [`create_attached_exec`] supplies. It
-/// stays the single place an attached exec is opened.
+/// Only base-image migration calls this directly: replaying `apt` and unpacking
+/// a payload tar at `/` have to run as **root**. Everything else goes through
+/// `host::ContainerTarget::attach`.
 pub async fn create_attached_exec_as(
     container_id: &str,
     cmd: Vec<String>,
     tty: bool,
     user: &str,
     working_dir: &str,
+) -> Result<AttachedExec, String> {
+    let spec = ExecSpec::new(cmd)
+        .tty(tty)
+        .user(user)
+        .working_dir(Some(working_dir));
+    create_attached_exec_spec(container_id, &spec).await
+}
+
+/// The single place an attached exec is opened on Docker. Everything else —
+/// [`create_attached_exec_as`] and `host::ContainerTarget::attach` — is a thin
+/// wrapper over this.
+pub async fn create_attached_exec_spec(
+    container_id: &str,
+    spec: &ExecSpec,
 ) -> Result<AttachedExec, String> {
     let docker = get_docker()?;
 
@@ -60,13 +46,14 @@ pub async fn create_attached_exec_as(
         .create_exec(
             container_id,
             CreateExecOptions {
-                attach_stdin: Some(true),
+                attach_stdin: Some(spec.attach_stdin),
                 attach_stdout: Some(true),
                 attach_stderr: Some(true),
-                tty: Some(tty),
-                cmd: Some(cmd),
-                user: Some(user.to_string()),
-                working_dir: Some(working_dir.to_string()),
+                tty: Some(spec.tty),
+                cmd: Some(spec.cmd.clone()),
+                env: if spec.env.is_empty() { None } else { Some(spec.env.clone()) },
+                user: Some(spec.user.clone()),
+                working_dir: spec.working_dir.clone(),
                 ..Default::default()
             },
         )
@@ -82,244 +69,87 @@ pub async fn create_attached_exec_as(
     {
         StartExecResults::Attached { output, input } => Ok(AttachedExec {
             exec_id,
-            output,
+            output: Box::pin(output.map(|r| {
+                r.map(log_output_to_chunk)
+                    .map_err(|e| e.to_string())
+            })),
             input,
         }),
         StartExecResults::Detached => Err("Exec started in detached mode".to_string()),
     }
 }
 
-pub struct ExecSession {
-    pub exec_id: String,
-    pub container_id: String,
-    pub input_tx: mpsc::UnboundedSender<Vec<u8>>,
-    shutdown_tx: mpsc::Sender<()>,
-}
-
-impl ExecSession {
-    pub async fn send_input(&self, data: Vec<u8>) -> Result<(), String> {
-        self.input_tx
-            .send(data)
-            .map_err(|e| format!("Failed to send input: {}", e))
-    }
-
-    #[allow(dead_code)]
-    pub async fn resize(&self, cols: u16, rows: u16) -> Result<(), String> {
-        let docker = get_docker()?;
-        docker
-            .resize_exec(
-                &self.exec_id,
-                ResizeExecOptions {
-                    width: cols,
-                    height: rows,
-                },
-            )
-            .await
-            .map_err(|e| format!("Failed to resize exec: {}", e))
-    }
-
-    pub fn shutdown(&self) {
-        let _ = self.shutdown_tx.try_send(());
+/// bollard's `LogOutput` → the host-neutral [`ExecChunk`]. `Console` is what
+/// Docker calls a TTY stream; it has no stderr, so it is stdout.
+pub fn log_output_to_chunk(o: LogOutput) -> ExecChunk {
+    match o {
+        LogOutput::StdOut { message } | LogOutput::Console { message } => ExecChunk::StdOut(message),
+        LogOutput::StdErr { message } => ExecChunk::StdErr(message),
+        LogOutput::StdIn { message } => ExecChunk::Other(message),
     }
 }
 
-pub struct ExecSessionManager {
-    sessions: Arc<Mutex<HashMap<String, ExecSession>>>,
+/// Start a command with nothing attached and return its exec id without
+/// waiting for it.
+pub async fn exec_detached(container_id: &str, spec: &ExecSpec) -> Result<String, String> {
+    let docker = get_docker()?;
+    let exec = docker
+        .create_exec(
+            container_id,
+            CreateExecOptions {
+                attach_stdout: Some(false),
+                attach_stderr: Some(false),
+                tty: Some(spec.tty),
+                cmd: Some(spec.cmd.clone()),
+                env: if spec.env.is_empty() { None } else { Some(spec.env.clone()) },
+                user: Some(spec.user.clone()),
+                working_dir: spec.working_dir.clone(),
+                ..Default::default()
+            },
+        )
+        .await
+        .map_err(|e| format!("Failed to create exec: {}", e))?;
+    docker
+        .start_exec(
+            &exec.id,
+            Some(bollard::exec::StartExecOptions {
+                detach: true,
+                ..Default::default()
+            }),
+        )
+        .await
+        .map_err(|e| format!("Failed to start exec: {}", e))?;
+    Ok(exec.id)
 }
 
-impl ExecSessionManager {
-    pub fn new() -> Self {
-        Self {
-            sessions: Arc::new(Mutex::new(HashMap::new())),
-        }
-    }
-
-    pub async fn create_session<F>(
-        &self,
-        container_id: &str,
-        session_id: &str,
-        cmd: Vec<String>,
-        on_output: F,
-        on_exit: Box<dyn FnOnce() + Send>,
-    ) -> Result<(), String>
-    where
-        F: Fn(Vec<u8>) + Send + 'static,
-    {
-        self.create_session_with_tty(container_id, session_id, cmd, true, on_output, on_exit)
-            .await
-    }
-
-    pub async fn create_session_with_tty<F>(
-        &self,
-        container_id: &str,
-        session_id: &str,
-        cmd: Vec<String>,
-        tty: bool,
-        on_output: F,
-        on_exit: Box<dyn FnOnce() + Send>,
-    ) -> Result<(), String>
-    where
-        F: Fn(Vec<u8>) + Send + 'static,
-    {
-        let AttachedExec {
+pub async fn resize_exec(exec_id: &str, cols: u16, rows: u16) -> Result<(), String> {
+    let docker = get_docker()?;
+    docker
+        .resize_exec(
             exec_id,
-            mut output,
-            mut input,
-        } = create_attached_exec(container_id, cmd, tty).await?;
+            ResizeExecOptions {
+                width: cols,
+                height: rows,
+            },
+        )
+        .await
+        .map_err(|e| format!("Failed to resize exec: {}", e))
+}
 
-        let (input_tx, mut input_rx) = mpsc::unbounded_channel::<Vec<u8>>();
-        let (shutdown_tx, mut shutdown_rx) = mpsc::channel::<()>(1);
-
-        // Output reader task
-        let session_id_clone = session_id.to_string();
-        let shutdown_tx_clone = shutdown_tx.clone();
-        tokio::spawn(async move {
-            loop {
-                tokio::select! {
-                    msg = output.next() => {
-                        match msg {
-                            Some(Ok(output)) => {
-                                on_output(output.into_bytes().to_vec());
-                            }
-                            Some(Err(e)) => {
-                                log::error!("Exec output error for {}: {}", session_id_clone, e);
-                                break;
-                            }
-                            None => {
-                                log::info!("Exec output stream ended for {}", session_id_clone);
-                                break;
-                            }
-                        }
-                    }
-                    _ = shutdown_rx.recv() => {
-                        log::info!("Exec session {} shutting down", session_id_clone);
-                        break;
-                    }
-                }
-            }
-            on_exit();
-            let _ = shutdown_tx_clone;
-        });
-
-        // Input writer task
-        tokio::spawn(async move {
-            while let Some(data) = input_rx.recv().await {
-                if let Err(e) = input.write_all(&data).await {
-                    log::error!("Failed to write to exec stdin: {}", e);
-                    break;
-                }
-            }
-        });
-
-        let session = ExecSession {
-            exec_id,
-            container_id: container_id.to_string(),
-            input_tx,
-            shutdown_tx,
-        };
-
-        self.sessions
-            .lock()
-            .await
-            .insert(session_id.to_string(), session);
-
-        Ok(())
-    }
-
-    pub async fn send_input(&self, session_id: &str, data: Vec<u8>) -> Result<(), String> {
-        let sessions = self.sessions.lock().await;
-        let session = sessions
-            .get(session_id)
-            .ok_or_else(|| format!("Session {} not found", session_id))?;
-        session.send_input(data).await
-    }
-
-    pub async fn resize(&self, session_id: &str, cols: u16, rows: u16) -> Result<(), String> {
-        // Clone the exec_id under the lock, then drop the lock before the
-        // async Docker API call to avoid holding the mutex across await.
-        let exec_id = {
-            let sessions = self.sessions.lock().await;
-            let session = sessions
-                .get(session_id)
-                .ok_or_else(|| format!("Session {} not found", session_id))?;
-            session.exec_id.clone()
-        };
-        let docker = get_docker()?;
-        docker
-            .resize_exec(
-                &exec_id,
-                ResizeExecOptions {
-                    width: cols,
-                    height: rows,
-                },
-            )
-            .await
-            .map_err(|e| format!("Failed to resize exec: {}", e))
-    }
-
-    pub async fn close_session(&self, session_id: &str) {
-        let mut sessions = self.sessions.lock().await;
-        if let Some(session) = sessions.remove(session_id) {
-            session.shutdown();
-        }
-    }
-
-    pub async fn close_sessions_for_container(&self, container_id: &str) {
-        let mut sessions = self.sessions.lock().await;
-        let ids_to_close: Vec<String> = sessions
-            .iter()
-            .filter(|(_, s)| s.container_id == container_id)
-            .map(|(id, _)| id.clone())
-            .collect();
-        for id in ids_to_close {
-            if let Some(session) = sessions.remove(&id) {
-                session.shutdown();
-            }
-        }
-    }
-
-    pub async fn close_all_sessions(&self) {
-        let mut sessions = self.sessions.lock().await;
-        for (_, session) in sessions.drain() {
-            session.shutdown();
-        }
-    }
-
-    pub async fn get_container_id(&self, session_id: &str) -> Result<String, String> {
-        let sessions = self.sessions.lock().await;
-        let session = sessions
-            .get(session_id)
-            .ok_or_else(|| format!("Session {} not found", session_id))?;
-        Ok(session.container_id.clone())
-    }
-
-    pub async fn write_file_to_container(
-        &self,
-        container_id: &str,
-        file_name: &str,
-        data: &[u8],
-    ) -> Result<String, String> {
-        let docker = get_docker()?;
-
-        // Owned by the container user, stamped now: a default tar header would
-        // land it as root:root/1970 and Claude Code could not rewrite it.
-        let (uid, gid) = container_user_ids(container_id).await;
-        let tar_buf = build_single_file_tar(file_name, data, 0o644, uid, gid, now_epoch_secs())?;
-
-        docker
-            .upload_to_container(
-                container_id,
-                Some(UploadToContainerOptions {
-                    path: "/tmp".to_string(),
-                    ..Default::default()
-                }),
-                tar_buf.into(),
-            )
-            .await
-            .map_err(|e| format!("Failed to upload file to container: {}", e))?;
-
-        Ok(format!("/tmp/{}", file_name))
-    }
+/// Docker's archive API: `path` as a tar stream. Errors are stringified so the
+/// stream is host-neutral.
+pub fn download_archive(container_id: &str, path: &str) -> crate::host::ArchiveStream {
+    let docker = match get_docker() {
+        Ok(d) => d,
+        Err(e) => return Box::pin(futures_util::stream::once(async move { Err(e) })),
+    };
+    let stream = docker.download_from_container(
+        container_id,
+        Some(bollard::container::DownloadFromContainerOptions {
+            path: path.to_string(),
+        }),
+    );
+    Box::pin(stream.map(|r| r.map_err(|e| e.to_string())))
 }
 
 /// Ceiling on one host file packed into a container upload.
@@ -376,31 +206,8 @@ pub async fn upload_host_file_with_ids(
     let mtime = now_epoch_secs();
 
     let tar_buf = tokio::task::spawn_blocking(move || -> Result<Vec<u8>, String> {
-        // The caller resolved this path (`resolve_host_read_path`); opening it
-        // is a second trip through the same directories, so the descriptor is
-        // checked against the path that was validated before its bytes are
-        // packed into anything. Two paths reach here: the terminal's drop
-        // target, and the Files pane's upload via `upload_host_file_with_ids`.
-        // Between them they are how host bytes enter a container.
-        let file = std::fs::File::open(&host_path)
-            .map_err(|e| format!("Failed to read {}: {}", host_path, e))?;
-        crate::commands::file_commands::verify_opened_path(
-            &file,
-            std::path::Path::new(&host_path),
-        )?;
-        let mut data = Vec::new();
-        std::io::Read::read_to_end(
-            &mut std::io::Read::take(file, MAX_DROP_BYTES.saturating_add(1)),
-            &mut data,
-        )
-        .map_err(|e| format!("Failed to read {}: {}", host_path, e))?;
-        if data.len() as u64 > MAX_DROP_BYTES {
-            return Err(format!(
-                "File too large to upload (limit {} MB)",
-                MAX_DROP_BYTES / (1024 * 1024)
-            ));
-        }
-        build_single_file_tar(&dest_for_blk, &data[..], 0o644, uid, gid, mtime)
+        let data = read_host_file_for_upload(&host_path)?;
+        build_single_file_tar(&dest_for_blk, &data[..], HOST_FILE_UPLOAD_MODE, uid, gid, mtime)
     })
     .await
     .map_err(|e| format!("Upload task panicked: {}", e))??;
@@ -421,13 +228,46 @@ pub async fn upload_host_file_with_ids(
     Ok(container_join(dest_dir, &dest_name))
 }
 
+/// The mode a host file lands with in the container, on every host.
+pub(crate) const HOST_FILE_UPLOAD_MODE: u32 = 0o644;
+
+/// Read a host file that is about to be copied into a container. Blocking:
+/// call it from `spawn_blocking`. Shared by every host's upload so the checks
+/// cannot drift apart.
+///
+/// The caller resolved this path (`resolve_host_read_path`); opening it is a
+/// second trip through the same directories, so the descriptor is checked
+/// against the path that was validated before its bytes are packed into
+/// anything. Two paths reach here: the terminal's drop target, and the Files
+/// pane's upload via `upload_host_file_with_ids`. Between them they are how
+/// host bytes enter a container. [`MAX_DROP_BYTES`] is applied to what the
+/// open descriptor actually yields, not to an earlier `stat`.
+pub(crate) fn read_host_file_for_upload(host_path: &str) -> Result<Vec<u8>, String> {
+    let file = std::fs::File::open(host_path)
+        .map_err(|e| format!("Failed to read {}: {}", host_path, e))?;
+    crate::commands::file_commands::verify_opened_path(&file, std::path::Path::new(host_path))?;
+    let mut data = Vec::new();
+    std::io::Read::read_to_end(
+        &mut std::io::Read::take(file, MAX_DROP_BYTES.saturating_add(1)),
+        &mut data,
+    )
+    .map_err(|e| format!("Failed to read {}: {}", host_path, e))?;
+    if data.len() as u64 > MAX_DROP_BYTES {
+        return Err(format!(
+            "File too large to upload (limit {} MB)",
+            MAX_DROP_BYTES / (1024 * 1024)
+        ));
+    }
+    Ok(data)
+}
+
 /// Join a container directory to a name that may itself carry separators.
 ///
 /// Only the *reported* path — the bytes have already landed by the time this is
 /// called — but that path is what the terminal echoes and what the Files pane
 /// puts in its toast, so `/tmp//x` reading back as a different file than `/tmp/x`
 /// is worth the four lines. `"/"` trims to `""` and yields `/x`.
-fn container_join(dir: &str, name: &str) -> String {
+pub(crate) fn container_join(dir: &str, name: &str) -> String {
     format!("{}/{}", dir.trim_end_matches('/'), name.trim_start_matches('/'))
 }
 
@@ -444,14 +284,22 @@ pub async fn upload_bytes_to_container(
     file_name: &str,
     data: &[u8],
     mode: u32,
+) -> Result<String, String> {
+    upload_bytes_with_ids(container_id, dest_dir, file_name, data, mode, (0, 0)).await
+}
+
+/// [`upload_bytes_to_container`] with the tar header's owner set, stamped now.
+pub async fn upload_bytes_with_ids(
+    container_id: &str,
+    dest_dir: &str,
+    file_name: &str,
+    data: &[u8],
+    mode: u32,
+    (uid, gid): (u64, u64),
 ) -> Result<String, String> {
     let docker = get_docker()?;
 
-    // Root-owned on purpose: migration's `tar -T` list is read back as root,
-    // and the marketplace sync uploads into a `claude`-owned directory it
-    // prepares first, so `claude` can still read and delete the files. The
-    // mtime still gets stamped so the file doesn't read as 1970.
-    let tar_buf = build_single_file_tar(file_name, data, mode, 0, 0, now_epoch_secs())?;
+    let tar_buf = build_single_file_tar(file_name, data, mode, uid, gid, now_epoch_secs())?;
 
     docker
         .upload_to_container(
@@ -524,12 +372,26 @@ pub async fn container_user_ids(container_id: &str) -> (u64, u64) {
     let (out, _) = exec_oneshot_limited(
         container_id,
         "claude",
-        vec!["sh".to_string(), "-c".to_string(), "id -u; id -g".to_string()],
-        256,
+        user_ids_cmd(),
+        USER_IDS_OUTPUT_LIMIT,
     )
     .await
     .unwrap_or_default();
+    parse_user_ids(&out)
+}
 
+/// The command [`container_user_ids`] runs (as `claude`, under
+/// [`USER_IDS_OUTPUT_LIMIT`]); every host asks the same question.
+pub(crate) fn user_ids_cmd() -> Vec<String> {
+    vec!["sh".to_string(), "-c".to_string(), "id -u; id -g".to_string()]
+}
+
+/// Output ceiling for the uid probe: two short numbers.
+pub(crate) const USER_IDS_OUTPUT_LIMIT: usize = 256;
+
+/// `id -u; id -g` output -> `(uid, gid)`, falling back to the image's
+/// build-time `(1000, 1000)`.
+pub(crate) fn parse_user_ids(out: &str) -> (u64, u64) {
     let mut ids = out.lines().filter_map(|l| l.trim().parse::<u64>().ok());
     match (ids.next(), ids.next()) {
         (Some(uid), Some(gid)) => (uid, gid),
@@ -657,21 +519,54 @@ pub async fn exec_oneshot_as(
 /// fail". `stdout_ranges` indexes the parts of it that came from stdout, so a
 /// caller that is *parsing* output can have just that without the buffer being
 /// held twice.
-struct OneshotOutput {
+pub(crate) struct OneshotOutput {
     combined: Vec<u8>,
     stdout_ranges: Vec<(usize, usize)>,
-    exit_code: i64,
+    pub(crate) exit_code: i64,
+}
+
+/// The refusal for output past `limit`, starting with [`OUTPUT_LIMIT_MARKER`].
+pub(crate) fn output_limit_error(limit: usize) -> String {
+    format!(
+        "{}: Command output exceeded {} bytes and was abandoned",
+        OUTPUT_LIMIT_MARKER, limit
+    )
 }
 
 impl OneshotOutput {
+    pub(crate) fn new() -> Self {
+        Self {
+            combined: Vec::new(),
+            stdout_ranges: Vec::new(),
+            exit_code: 0,
+        }
+    }
+
+    /// Append one chunk in arrival order, or refuse it (appending nothing)
+    /// once the combined output would pass `limit`. The caller must stop
+    /// reading on an error rather than truncate silently: every caller parses
+    /// this output, and a half-read manifest or JSON array is worse than an
+    /// error.
+    pub(crate) fn push(&mut self, from_stdout: bool, bytes: &[u8], limit: usize) -> Result<(), String> {
+        match push_capped(&mut self.combined, bytes, limit) {
+            Some(range) => {
+                if from_stdout {
+                    self.stdout_ranges.push(range);
+                }
+                Ok(())
+            }
+            None => Err(output_limit_error(limit)),
+        }
+    }
+
     /// Everything the command printed, in the order it printed it.
-    fn text(&self) -> String {
+    pub(crate) fn text(&self) -> String {
         String::from_utf8_lossy(&self.combined).into_owned()
     }
 
     /// stdout alone — for callers that parse it, where a diagnostic spliced in
     /// mid-record is a parse error at best.
-    fn stdout(&self) -> String {
+    pub(crate) fn stdout(&self) -> String {
         let mut out = Vec::with_capacity(self.combined.len());
         for (start, end) in &self.stdout_ranges {
             out.extend_from_slice(&self.combined[*start..*end]);
@@ -680,7 +575,7 @@ impl OneshotOutput {
     }
 
     /// stderr alone — the complement of [`Self::stdout`], i.e. the diagnostics.
-    fn stderr(&self) -> String {
+    pub(crate) fn stderr(&self) -> String {
         let mut out = Vec::with_capacity(self.combined.len());
         let mut cursor = 0usize;
         for (start, end) in &self.stdout_ranges {
@@ -749,8 +644,7 @@ async fn exec_oneshot_raw(
         .await
         .map_err(|e| format!("Failed to start exec: {}", e))?;
 
-    let mut combined: Vec<u8> = Vec::new();
-    let mut stdout_ranges: Vec<(usize, usize)> = Vec::new();
+    let mut out = OneshotOutput::new();
     match result {
         StartExecResults::Attached { mut output, .. } => {
             while let Some(msg) = output.next().await {
@@ -758,23 +652,9 @@ async fn exec_oneshot_raw(
                     Ok(data) => {
                         let from_stdout = matches!(data, LogOutput::StdOut { .. });
                         let bytes = data.into_bytes();
-                        match push_capped(&mut combined, &bytes, limit) {
-                            Some(range) => {
-                                if from_stdout {
-                                    stdout_ranges.push(range);
-                                }
-                            }
-                            // Stop reading rather than truncate silently: every
-                            // caller parses this output, and a half-read
-                            // manifest or JSON array is worse than an error.
-                            // Dropping `output` kills the exec's stream.
-                            None => {
-                                return Err(format!(
-                                    "{}: Command output exceeded {} bytes and was abandoned",
-                                    OUTPUT_LIMIT_MARKER, limit
-                                ))
-                            }
-                        }
+                        // Over the limit: returning drops `output`, which
+                        // kills the exec's stream.
+                        out.push(from_stdout, &bytes, limit)?;
                     }
                     Err(e) => return Err(format!("Exec output error: {}", e)),
                 }
@@ -785,13 +665,8 @@ async fn exec_oneshot_raw(
 
     // The output stream draining doesn't strictly guarantee inspect_exec has the
     // final exit_code populated yet, so poll until the exec reports finished.
-    let exit_code = require_exit_code(wait_for_exec_exit(&exec.id).await)?;
-
-    Ok(OneshotOutput {
-        combined,
-        stdout_ranges,
-        exit_code,
-    })
+    out.exit_code = require_exit_code(wait_for_exec_exit(&exec.id).await)?;
+    Ok(out)
 }
 
 /// Turn "the exit code could not be determined" into an error rather than a 0.
@@ -824,7 +699,7 @@ fn require_exit_code(code: Option<i64>) -> Result<i64, String> {
 /// spurious "the rename failed" and a real one.
 pub async fn wait_for_exec_exit(exec_id: &str) -> Option<i64> {
     let docker = get_docker().ok()?;
-    for _ in 0..200 {
+    for _ in 0..EXEC_EXIT_POLLS {
         match docker.inspect_exec(exec_id).await {
             Ok(info) => {
                 if info.running != Some(true) {
@@ -843,30 +718,27 @@ pub async fn wait_for_exec_exit(exec_id: &str) -> Option<i64> {
             }
             Err(_) => return None,
         }
-        tokio::time::sleep(std::time::Duration::from_millis(25)).await;
+        tokio::time::sleep(EXEC_EXIT_POLL_INTERVAL).await;
     }
     None
 }
 
+/// [`wait_for_exec_exit`]'s budget: polls, and the pause between them. Every
+/// host's `wait_exec_exit` uses the same numbers.
+pub(crate) const EXEC_EXIT_POLLS: usize = 200;
+pub(crate) const EXEC_EXIT_POLL_INTERVAL: std::time::Duration = std::time::Duration::from_millis(25);
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
     /// The frames a demultiplexed exec hands back, as `(is_stdout, bytes)`.
     fn collect(frames: &[(bool, &[u8])]) -> OneshotOutput {
-        let mut combined = Vec::new();
-        let mut stdout_ranges = Vec::new();
+        let mut out = OneshotOutput::new();
         for (from_stdout, bytes) in frames {
-            let range = push_capped(&mut combined, bytes, usize::MAX).unwrap();
-            if *from_stdout {
-                stdout_ranges.push(range);
-            }
-        }
-        OneshotOutput {
-            combined,
-            stdout_ranges,
-            exit_code: 0,
+            out.push(*from_stdout, bytes, usize::MAX).unwrap();
         }
+        out
     }
 
     #[test]
@@ -925,10 +797,7 @@ mod tests {
         // The marker is what lets `list_container_files` say "too many entries"
         // instead, which is the thing that actually happened.
         assert!(!OUTPUT_LIMIT_MARKER.is_empty());
-        let refusal = format!(
-            "{}: Command output exceeded {} bytes and was abandoned",
-            OUTPUT_LIMIT_MARKER, MAX_ONESHOT_OUTPUT
-        );
+        let refusal = output_limit_error(MAX_ONESHOT_OUTPUT);
         assert!(refusal.starts_with(OUTPUT_LIMIT_MARKER));
     }
 

app/src-tauri/src/docker/image.rs

@@ -15,8 +15,18 @@ const TASK_RUNNER: &str = include_str!("../../../../container/triple-c-task-runn
 const OSC52_CLIPBOARD: &str = include_str!("../../../../container/osc52-clipboard");
 const AUDIO_SHIM: &str = include_str!("../../../../container/audio-shim");
 const SSO_REFRESH: &str = include_str!("../../../../container/triple-c-sso-refresh");
+const TRIPLE_C_OPEN: &str = include_str!("../../../../container/triple-c-open");
+const PLAYWRIGHT_HEAL: &str = include_str!("../../../../container/triple-c-playwright-heal");
+const WIP_PUSH: &str = include_str!("../../../../container/triple-c-wip-push");
+const IDLE_WATCH: &str = include_str!("../../../../container/triple-c-idle-watch");
 
 static MISSION_CONTROL_DIR: Dir = include_dir!("$CARGO_MANIFEST_DIR/../../container/mission-control");
+static SKILLS_DIR: Dir = include_dir!("$CARGO_MANIFEST_DIR/../../container/skills");
+// The agent crate's sources only — never the whole crate directory, which can
+// hold a multi-hundred-megabyte `target/` from a local build.
+const AGENT_CARGO_TOML: &str = include_str!("../../../../container/triple-c-agent/Cargo.toml");
+const AGENT_CARGO_LOCK: &str = include_str!("../../../../container/triple-c-agent/Cargo.lock");
+static AGENT_SRC_DIR: Dir = include_dir!("$CARGO_MANIFEST_DIR/../../container/triple-c-agent/src");
 
 pub async fn image_exists(image_name: &str) -> Result<bool, String> {
     let docker = get_docker()?;
@@ -137,10 +147,28 @@ where
 
     let tar_bytes = create_build_context().map_err(|e| format!("Failed to create build context: {}", e))?;
 
+    // The Dockerfile builds `triple-c-agent` in a stage pinned to
+    // `$BUILDPLATFORM` and cross-compiles for `$TARGETARCH`, so CI's arm64
+    // image compiles natively instead of under QEMU. BuildKit predefines both;
+    // the classic builder this API call uses does not, and an empty
+    // `--platform=` fails the build outright (verified, Engine 29.9). So pass
+    // them, describing the daemon's own platform: a local build is always
+    // native.
+    let arch = docker
+        .version()
+        .await
+        .ok()
+        .and_then(|v| v.arch)
+        .filter(|a| !a.is_empty())
+        .unwrap_or_else(|| native_docker_arch().to_string());
+    let build_platform = format!("linux/{}", arch);
+    let buildargs = local_build_args(&build_platform, &arch);
+
     let options = BuildImageOptions {
         t: full_name.as_str(),
         rm: true,
         forcerm: true,
+        buildargs,
         ..Default::default()
     };
 
@@ -191,6 +219,20 @@ fn append_embedded_dir(
     Ok(())
 }
 
+/// Docker's name for this machine's architecture, for when the daemon does
+/// not say.
+fn native_docker_arch() -> &'static str {
+    match std::env::consts::ARCH {
+        "aarch64" => "arm64",
+        "x86_64" => "amd64",
+        other => other,
+    }
+}
+
+fn local_build_args<'a>(build_platform: &'a str, arch: &'a str) -> HashMap<&'a str, &'a str> {
+    HashMap::from([("BUILDPLATFORM", build_platform), ("TARGETARCH", arch)])
+}
+
 fn create_build_context() -> Result<Vec<u8>, std::io::Error> {
     let mut buf = Vec::new();
     {
@@ -203,8 +245,16 @@ fn create_build_context() -> Result<Vec<u8>, std::io::Error> {
         append_file_to_archive(&mut archive, "osc52-clipboard", OSC52_CLIPBOARD.as_bytes(), 0o755)?;
         append_file_to_archive(&mut archive, "audio-shim", AUDIO_SHIM.as_bytes(), 0o755)?;
         append_file_to_archive(&mut archive, "triple-c-sso-refresh", SSO_REFRESH.as_bytes(), 0o755)?;
+        append_file_to_archive(&mut archive, "triple-c-open", TRIPLE_C_OPEN.as_bytes(), 0o755)?;
+        append_file_to_archive(&mut archive, "triple-c-playwright-heal", PLAYWRIGHT_HEAL.as_bytes(), 0o755)?;
+        append_file_to_archive(&mut archive, "triple-c-wip-push", WIP_PUSH.as_bytes(), 0o755)?;
+        append_file_to_archive(&mut archive, "triple-c-idle-watch", IDLE_WATCH.as_bytes(), 0o755)?;
 
         append_embedded_dir(&mut archive, &MISSION_CONTROL_DIR, "mission-control")?;
+        append_embedded_dir(&mut archive, &SKILLS_DIR, "skills")?;
+        append_file_to_archive(&mut archive, "triple-c-agent/Cargo.toml", AGENT_CARGO_TOML.as_bytes(), 0o644)?;
+        append_file_to_archive(&mut archive, "triple-c-agent/Cargo.lock", AGENT_CARGO_LOCK.as_bytes(), 0o644)?;
+        append_embedded_dir(&mut archive, &AGENT_SRC_DIR, "triple-c-agent/src")?;
 
         archive.finish()?;
     }
@@ -213,6 +263,46 @@ fn create_build_context() -> Result<Vec<u8>, std::io::Error> {
     Ok(buf)
 }
 
+#[cfg(test)]
+mod build_context_tests {
+    use super::{create_build_context, DOCKERFILE};
+
+    /// The local build (`ImageSource::LocalBuild`) ships the Dockerfile with a
+    /// hand-assembled context, and nothing else checks the two agree: CI builds
+    /// from the real `container/` directory, so a `COPY` of something missing
+    /// here only fails for users who build locally. That went unnoticed for
+    /// `skills`, `triple-c-open` and `triple-c-playwright-heal`. Every `COPY`
+    /// source (not `--from=` stages) must be present as a file or directory
+    /// prefix in the archive.
+    #[test]
+    fn every_dockerfile_copy_source_is_in_the_local_build_context() {
+        let tar_bytes = create_build_context().expect("context builds");
+        let mut archive = tar::Archive::new(&tar_bytes[..]);
+        let paths: Vec<String> = archive
+            .entries()
+            .unwrap()
+            .map(|e| e.unwrap().path().unwrap().to_string_lossy().into_owned())
+            .collect();
+        let mut missing = Vec::new();
+        for line in DOCKERFILE.lines() {
+            let line = line.trim();
+            let Some(rest) = line.strip_prefix("COPY ") else { continue };
+            let args: Vec<&str> = rest.split_whitespace().filter(|a| !a.starts_with("--")).collect();
+            if rest.contains("--from=") || args.len() < 2 {
+                continue;
+            }
+            for src in &args[..args.len() - 1] {
+                let src = src.trim_end_matches('/');
+                let present = paths.iter().any(|p| p == src || p.starts_with(&format!("{}/", src)));
+                if !present {
+                    missing.push(src.to_string());
+                }
+            }
+        }
+        assert!(missing.is_empty(), "COPY sources missing from the local build context: {:?}", missing);
+    }
+}
+
 #[cfg(all(test, unix))]
 mod tests {
     use super::ENTRYPOINT;

app/src-tauri/src/docker/mod.rs

@@ -1,12 +1,16 @@
 pub mod ca_certs;
 pub mod client;
+pub mod events;
 pub mod container;
+pub mod workspace_env;
 pub mod image;
 pub mod exec;
 pub mod gateway;
 pub mod legacy_cleanup;
 pub mod migration;
 pub mod stt;
+#[cfg(all(test, unix))]
+mod aws_mode_tests;
 
 /// The container user `claude`'s home directory, as the image creates it.
 pub(crate) const CONTAINER_HOME: &str = "/home/claude";

app/src-tauri/src/docker/workspace_env.rs

@@ -0,0 +1,699 @@
+//! The container environment a project gets, built once for every host.
+//!
+//! Docker passes these pairs as the container's `Env`; the AWS host stores the
+//! very same pairs in a per-project Secrets Manager secret. Both therefore call
+//! [`workspace_env`], so a backend, a CA bundle or a custom variable cannot
+//! reach one host and not the other.
+//!
+//! What is *not* here: `COLORTERM`, `HOST_UID` and `HOST_GID` (host-specific,
+//! assembled by `create_container`), and anything that needs the host — the
+//! corporate CA is resolved from disk and the shared Claude token read from
+//! the keychain by the caller, then handed in through [`WorkspaceEnvInputs`].
+//! Order is part of the contract: it is the order `docker inspect` shows.
+
+use super::ca_certs::{self, ResolvedCa};
+use super::container::{
+    build_claude_code_settings_json, build_claude_instructions, claude_code_env_vars,
+    compute_env_fingerprint, compute_model_aliases, is_reserved_env_key, merge_claude_code_settings,
+    merge_custom_env_vars, resolve_with_global, split_claude_code_settings_payload, vpn_env_var,
+    ANTHROPIC_DEFAULT_FABLE_MODEL, ANTHROPIC_DEFAULT_HAIKU_MODEL, ANTHROPIC_DEFAULT_OPUS_MODEL,
+    ANTHROPIC_DEFAULT_SONNET_MODEL, CLAUDE_OAUTH_TOKEN_ENV,
+};
+use crate::models::{
+    Backend, BedrockAuthMethod, ClaudeCodeSettings, EnvVar, GlobalAwsSettings,
+    GlobalLlamaCppSettings, GlobalOllamaSettings, GlobalOpenAiCompatibleSettings, Project,
+};
+
+/// Everything besides the project that shapes its environment.
+pub(crate) struct WorkspaceEnvInputs<'a> {
+    pub global_aws: &'a GlobalAwsSettings,
+    pub global_ollama: &'a GlobalOllamaSettings,
+    pub global_llamacpp: &'a GlobalLlamaCppSettings,
+    pub global_openai_compatible: &'a GlobalOpenAiCompatibleSettings,
+    pub global_claude_instructions: Option<&'a str>,
+    pub global_custom_env_vars: &'a [EnvVar],
+    pub timezone: Option<&'a str>,
+    pub global_claude_code_settings: Option<&'a ClaudeCodeSettings>,
+    pub default_git_user_name: Option<&'a str>,
+    pub default_git_user_email: Option<&'a str>,
+    /// The corporate CA, already resolved from disk (`ca_certs::resolve`).
+    pub resolved_ca: Option<&'a ResolvedCa>,
+    /// The shared Claude OAuth token, already read from the keychain and
+    /// already filtered by `shared_claude_auth` (backend, opt-out, non-blank).
+    pub shared_claude_token: Option<&'a str>,
+}
+
+/// `"KEY=VALUE"` to a pair, splitting at the first `=` (values may contain `=`).
+fn split_pair(entry: &str) -> (String, String) {
+    match entry.split_once('=') {
+        Some((k, v)) => (k.to_string(), v.to_string()),
+        None => (entry.to_string(), String::new()),
+    }
+}
+
+/// The `KEY=VALUE` pairs a project's container gets, in order, excluding the
+/// host-specific ones. See the module docs.
+pub(crate) fn workspace_env(
+    project: &Project,
+    inputs: &WorkspaceEnvInputs,
+) -> Vec<(String, String)> {
+    let WorkspaceEnvInputs {
+        global_aws,
+        global_ollama,
+        global_llamacpp,
+        global_openai_compatible,
+        global_claude_instructions,
+        global_custom_env_vars,
+        timezone,
+        global_claude_code_settings,
+        default_git_user_name,
+        default_git_user_email,
+        resolved_ca,
+        shared_claude_token,
+    } = *inputs;
+    let mut env: Vec<(String, String)> = Vec::new();
+
+    if let Some(ref token) = project.git_token {
+        env.push(("GIT_TOKEN".to_string(), token.to_string()));
+    }
+    // Per-project git user overrides global defaults
+    let effective_git_name = project.git_user_name.as_deref().or(default_git_user_name);
+    let effective_git_email = project.git_user_email.as_deref().or(default_git_user_email);
+    if let Some(name) = effective_git_name {
+        env.push(("GIT_USER_NAME".to_string(), name.to_string()));
+    }
+    if let Some(email) = effective_git_email {
+        env.push(("GIT_USER_EMAIL".to_string(), email.to_string()));
+    }
+
+    // Bedrock configuration
+    if project.backend == Backend::Bedrock {
+        if let Some(ref bedrock) = project.bedrock_config {
+            env.push(("CLAUDE_CODE_USE_BEDROCK".to_string(), "1".to_string()));
+
+            // AWS region: per-project overrides global
+            let region = if !bedrock.aws_region.is_empty() {
+                Some(bedrock.aws_region.clone())
+            } else {
+                global_aws.aws_region.clone()
+            };
+            if let Some(ref r) = region {
+                env.push(("AWS_REGION".to_string(), r.to_string()));
+            }
+
+            match bedrock.auth_method {
+                BedrockAuthMethod::StaticCredentials => {
+                    // Static/session credentials are NOT injected as env vars.
+                    // They are written to ~/.aws/credentials by
+                    // sync_bedrock_credentials() on every container
+                    // start, so rotated/updated keys are picked up without a
+                    // full container recreation (and never get baked into the
+                    // snapshot image). The empty values set by the
+                    // MANAGED_AUTH_KEYS neutralization pass below are ignored by
+                    // the AWS SDK, which falls through to the credentials file.
+                }
+                BedrockAuthMethod::Profile => {
+                    // Per-project profile overrides global
+                    let profile = bedrock.aws_profile.as_ref()
+                        .or(global_aws.aws_profile.as_ref());
+                    if let Some(p) = profile {
+                        env.push(("AWS_PROFILE".to_string(), p.to_string()));
+                    }
+                    env.push(("AWS_SSO_AUTH_REFRESH_CMD".to_string(), "triple-c-sso-refresh".to_string()));
+                }
+                BedrockAuthMethod::BearerToken => {
+                    if let Some(ref token) = bedrock.aws_bearer_token {
+                        env.push(("AWS_BEARER_TOKEN_BEDROCK".to_string(), token.to_string()));
+                    }
+                }
+            }
+
+            if let Some(model) = resolve_with_global(
+                bedrock.model_id.as_deref(),
+                global_aws.default_model_id.as_deref(),
+            ) {
+                env.push(("ANTHROPIC_MODEL".to_string(), model.to_string()));
+            }
+
+            if bedrock.disable_prompt_caching {
+                env.push(("DISABLE_PROMPT_CACHING".to_string(), "1".to_string()));
+            }
+
+            if let Some(ref tier) = bedrock.service_tier {
+                let trimmed = tier.trim();
+                if !trimmed.is_empty() {
+                    env.push(("ANTHROPIC_BEDROCK_SERVICE_TIER".to_string(), trimmed.to_string()));
+                }
+            }
+        }
+    }
+
+    // ── Custom-endpoint backends ─────────────────────────────────────────────
+    // Ollama, llama.cpp and the OpenAI-Compatible gateway all point Claude Code
+    // at a non-Anthropic server via ANTHROPIC_BASE_URL. Each resolves its model
+    // id here; the model-alias vars are emitted once below, from
+    // `alias_model` / `alias_haiku`, so the three backends cannot drift apart.
+    let mut alias_model: Option<String> = None;
+    let mut alias_haiku: Option<String> = None;
+
+    // Ollama configuration
+    if project.backend == Backend::Ollama {
+        if let Some(ref ollama) = project.ollama_config {
+            if let Some(url) = resolve_with_global(
+                Some(&ollama.base_url),
+                global_ollama.base_url.as_deref(),
+            ) {
+                env.push(("ANTHROPIC_BASE_URL".to_string(), url.to_string()));
+            }
+            env.push(("ANTHROPIC_AUTH_TOKEN".to_string(), "ollama".to_string()));
+            if let Some(model) = resolve_with_global(
+                ollama.model_id.as_deref(),
+                global_ollama.default_model_id.as_deref(),
+            ) {
+                env.push(("ANTHROPIC_MODEL".to_string(), model.to_string()));
+                alias_model = Some(model.to_string());
+            }
+            alias_haiku = resolve_with_global(
+                ollama.haiku_model_id.as_deref(),
+                global_ollama.default_haiku_model_id.as_deref(),
+            )
+            .map(str::to_string);
+        }
+    }
+
+    // llama.cpp (llama-server) configuration
+    if project.backend == Backend::LlamaCpp {
+        if let Some(ref cfg) = project.llamacpp_config {
+            if let Some(url) = resolve_with_global(
+                Some(&cfg.base_url),
+                global_llamacpp.base_url.as_deref(),
+            ) {
+                env.push(("ANTHROPIC_BASE_URL".to_string(), url.to_string()));
+            }
+            // llama-server only enforces an Authorization header when it was
+            // started with `--api-key` (default: none), so the value here is
+            // ignored in the common case. Claude Code still refuses to run
+            // against a custom base URL with no credential at all, so a
+            // placeholder is always sent — same trick as the Ollama branch
+            // above, which sends the literal "ollama".
+            env.push(("ANTHROPIC_AUTH_TOKEN".to_string(), "llama.cpp".to_string()));
+            if let Some(model) = resolve_with_global(
+                cfg.model_id.as_deref(),
+                global_llamacpp.default_model_id.as_deref(),
+            ) {
+                env.push(("ANTHROPIC_MODEL".to_string(), model.to_string()));
+                alias_model = Some(model.to_string());
+            }
+            alias_haiku = resolve_with_global(
+                cfg.haiku_model_id.as_deref(),
+                global_llamacpp.default_haiku_model_id.as_deref(),
+            )
+            .map(str::to_string);
+        }
+    }
+
+    // OpenAI Compatible configuration
+    if project.backend == Backend::OpenAiCompatible {
+        if let Some(ref config) = project.openai_compatible_config {
+            if let Some(url) = resolve_with_global(
+                Some(&config.base_url),
+                global_openai_compatible.base_url.as_deref(),
+            ) {
+                env.push(("ANTHROPIC_BASE_URL".to_string(), url.to_string()));
+            }
+            if let Some(ref key) = config.api_key {
+                env.push(("ANTHROPIC_AUTH_TOKEN".to_string(), key.to_string()));
+            }
+            if let Some(model) = resolve_with_global(
+                config.model_id.as_deref(),
+                global_openai_compatible.default_model_id.as_deref(),
+            ) {
+                env.push(("ANTHROPIC_MODEL".to_string(), model.to_string()));
+                alias_model = Some(model.to_string());
+            }
+            alias_haiku = resolve_with_global(
+                config.haiku_model_id.as_deref(),
+                global_openai_compatible.default_haiku_model_id.as_deref(),
+            )
+            .map(str::to_string);
+        }
+    }
+
+    // Model aliases — the fix for background Claude Code calls against a local
+    // server. Only for backends that talk to a custom endpoint: Anthropic and
+    // Bedrock reach servers that really do host the Anthropic model ids, so
+    // they keep Claude Code's own defaults. Anything not emitted here is
+    // blanked by the MANAGED_AUTH_KEYS pass below, so switching *away* from a
+    // custom endpoint clears the aliases out of the snapshot image too.
+    if project.backend.uses_custom_endpoint() {
+        for (key, value) in
+            compute_model_aliases(alias_model.as_deref(), alias_haiku.as_deref())
+        {
+            env.push((key.to_string(), value));
+        }
+    }
+
+    // Shared Claude Code OAuth token (Anthropic backend only, opt-out per
+    // project). Injected *before* the neutralization pass below so that pass
+    // sees it as already-set; when it is absent the pass actively blanks the
+    // variable instead of leaving a stale one baked into the snapshot image.
+    if let Some(token) = shared_claude_token {
+        env.push((CLAUDE_OAUTH_TOKEN_ENV.to_string(), token.to_string()));
+    }
+
+    // ── Corporate CA certificates ───────────────────────────────────────────
+    // Resolved here (rather than down with the mounts) so the env vars land
+    // *before* the neutralization pass below and are seen as already-set.
+    //
+    // A bad path is a hard error, not a warning: behind a TLS-terminating
+    // proxy a container without the CA fails every HTTPS call — npm, pip, git,
+    // and Claude Code's own API requests — each in its own confusing way. One
+    // message naming the path is far kinder.
+    //
+    // The values are set here rather than exported by the entrypoint because a
+    // terminal session is a `docker exec`, which sees the container's
+    // configured env and nothing the entrypoint exported. Same lesson as
+    // `$BROWSER` and the URL relay shim.
+    for (key, value) in ca_certs::ca_env_vars(resolved_ca) {
+        env.push((key.to_string(), value));
+    }
+
+    // ── Neutralize stale backend auth env vars ──────────────────────────────
+    // When a project switches backends (e.g. Bedrock → Anthropic) the container
+    // is recreated *from a snapshot image* committed off the previous container,
+    // and `docker commit` copies that container's full ENV into the image. So
+    // any auth var set under the old backend (e.g. CLAUDE_CODE_USE_BEDROCK=1,
+    // AWS_PROFILE, a model alias) survives in the image ENV and stays active
+    // unless we explicitly override it at create time.
+    //
+    // This pass is about *staleness*, not secrecy. It fixes the container it is
+    // building and does nothing to the image, so it is not — and never was —
+    // a defence against a credential baked into a snapshot. That is
+    // `commit_container_snapshot`'s job, via SECRET_ENV_KEYS.
+    // Create-time env takes precedence over image ENV, so we set every managed
+    // auth key the *current* backend did NOT set to an empty value, clearing the
+    // stale baked-in one.
+    const MANAGED_AUTH_KEYS: &[&str] = &[
+        "CLAUDE_CODE_USE_BEDROCK",
+        "AWS_REGION",
+        "AWS_ACCESS_KEY_ID",
+        "AWS_SECRET_ACCESS_KEY",
+        "AWS_SESSION_TOKEN",
+        "AWS_PROFILE",
+        "AWS_BEARER_TOKEN_BEDROCK",
+        "AWS_SSO_AUTH_REFRESH_CMD",
+        "ANTHROPIC_BASE_URL",
+        "ANTHROPIC_AUTH_TOKEN",
+        "ANTHROPIC_MODEL",
+        "DISABLE_PROMPT_CACHING",
+        "ANTHROPIC_BEDROCK_SERVICE_TIER",
+        // Switching from a custom-endpoint backend to Anthropic or Bedrock must
+        // *clear* the aliases, not merely stop setting them: a stale
+        // ANTHROPIC_DEFAULT_HAIKU_MODEL baked into the snapshot image would
+        // keep pointing background calls at a model id the new backend has
+        // never heard of.
+        ANTHROPIC_DEFAULT_OPUS_MODEL,
+        ANTHROPIC_DEFAULT_SONNET_MODEL,
+        ANTHROPIC_DEFAULT_HAIKU_MODEL,
+        ANTHROPIC_DEFAULT_FABLE_MODEL,
+        // Revoking the shared token, opting a project out, or switching away
+        // from the Anthropic backend must *clear* this, not merely stop setting
+        // it — otherwise the value committed into the snapshot image keeps
+        // authenticating the container with a credential the user removed.
+        CLAUDE_OAUTH_TOKEN_ENV,
+    ];
+    // Same reasoning for the CA vars — `ca_env` already emits them empty
+    // when no CA is configured, so this list is belt-and-braces for a snapshot
+    // committed by a build that predates the feature.
+    let managed_keys: Vec<&str> = MANAGED_AUTH_KEYS
+        .iter()
+        .copied()
+        .chain(ca_certs::CA_ENV_KEYS.iter().copied())
+        .collect();
+    let already_set: std::collections::HashSet<String> =
+        env.iter().map(|(k, _)| k.clone()).collect();
+    for key in &managed_keys {
+        if !already_set.contains(*key) {
+            env.push((key.to_string(), String::new()));
+        }
+    }
+
+    // Custom environment variables (global + per-project, project overrides global for same key)
+    let merged_env = merge_custom_env_vars(global_custom_env_vars, &project.custom_env_vars);
+    for env_var in &merged_env {
+        let key = env_var.key.trim();
+        if key.is_empty() {
+            continue;
+        }
+        if is_reserved_env_key(key) {
+            log::warn!("Skipping reserved env var: {}", key);
+            continue;
+        }
+        env.push((key.to_string(), env_var.value.clone()));
+    }
+    let custom_env_fingerprint = compute_env_fingerprint(&merged_env);
+    env.push(("TRIPLE_C_CUSTOM_ENV".to_string(), custom_env_fingerprint.to_string()));
+
+    // Container timezone
+    if let Some(tz) = timezone {
+        if !tz.is_empty() {
+            env.push(("TZ".to_string(), tz.to_string()));
+        }
+    }
+
+    // Mission Control env var
+    if project.mission_control_enabled {
+        env.push(("MISSION_CONTROL_ENABLED".to_string(), "1".to_string()));
+    }
+
+    env.push(split_pair(&vpn_env_var(project.vpn_support_enabled)));
+
+    // Permission mode — read by triple-c-task-runner for scheduled (headless)
+    // Claude Code runs. Interactive terminals get the flags directly instead.
+    env.push((
+        "TRIPLE_C_PERMISSION_MODE".to_string(),
+        project.effective_permission_mode().as_env_value().to_string(),
+    ));
+
+    // Claude instructions (global + per-project, plus port mapping info + scheduler docs)
+    let combined_instructions = build_claude_instructions(
+        global_claude_instructions,
+        project.claude_instructions.as_deref(),
+        &project.port_mappings,
+        project.mission_control_enabled,
+        project.sandbox_mode_enabled,
+    );
+
+    if let Some(ref instructions) = combined_instructions {
+        env.push(("CLAUDE_INSTRUCTIONS".to_string(), instructions.to_string()));
+    }
+
+    // Claude Code settings (global + per-project merged)
+    let merged_cc_settings = merge_claude_code_settings(
+        global_claude_code_settings,
+        project.claude_code_settings.as_ref(),
+    );
+    // Env-var-based settings, read directly by Claude Code. Extracted and unit
+    // tested for the `vpn_host_config` reason: a container is created once, by
+    // a very long function, and a variable emitted with the wrong value here is
+    // invisible until someone wonders why a switch does nothing.
+    env.extend(
+        claude_code_env_vars(merged_cc_settings.as_ref())
+            .iter()
+            .map(|entry| split_pair(entry)),
+    );
+
+    // settings.json-based settings (applied by the entrypoint). Always emitted,
+    // even with no `ClaudeCodeSettings` struct present: the payload asserts the
+    // *whole* managed key set, so "no settings" still has to be stated over a
+    // settings.json left behind on the config volume by a previous config.
+    // Split so the payload is safe under an older entrypoint that has never
+    // heard of the null-means-delete convention — see
+    // `split_claude_code_settings_payload`.
+    let (cc_settings_set, cc_settings_clear) = split_claude_code_settings_payload(
+        &build_claude_code_settings_json(merged_cc_settings.as_ref(), project.sandbox_mode_enabled),
+    );
+    env.push(("CLAUDE_CODE_SETTINGS_JSON".to_string(), cc_settings_set.to_string()));
+    env.push(("CLAUDE_CODE_SETTINGS_CLEAR".to_string(), cc_settings_clear.to_string()));
+
+    env
+}
+
+
+/// [`workspace_env`] with its inputs resolved from `settings` exactly as
+/// `create_container` resolves them (the CA from disk, the shared Claude
+/// token from the keychain), for a host that does not create a Docker
+/// container. Also returns the resolved CA, whose files the caller ships.
+pub(crate) fn workspace_env_from_settings(
+    project: &Project,
+    settings: &crate::models::AppSettings,
+) -> Result<crate::host::aws_host::AwsEnv, String> {
+    let shared_claude = super::container::shared_claude_auth(project);
+    let effective_ca_path =
+        resolve_with_global(project.ca_cert_path.as_deref(), settings.ca_cert_path.as_deref());
+    let resolved_ca = ca_certs::resolve(effective_ca_path)?;
+    let pairs = workspace_env(
+        project,
+        &WorkspaceEnvInputs {
+            global_aws: &settings.global_aws,
+            global_ollama: &settings.global_ollama,
+            global_llamacpp: &settings.global_llamacpp,
+            global_openai_compatible: &settings.global_openai_compatible,
+            global_claude_instructions: settings.global_claude_instructions.as_deref(),
+            global_custom_env_vars: &settings.global_custom_env_vars,
+            timezone: settings.timezone.as_deref(),
+            global_claude_code_settings: settings.global_claude_code_settings.as_ref(),
+            default_git_user_name: settings.default_git_user_name.as_deref(),
+            default_git_user_email: settings.default_git_user_email.as_deref(),
+            resolved_ca: resolved_ca.as_ref(),
+            shared_claude_token: shared_claude.as_ref().map(|(token, _)| token.as_str()),
+        },
+    );
+    Ok((pairs, resolved_ca))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::ca_certs::ResolvedCa;
+    use crate::models::*;
+    use std::path::PathBuf;
+
+    /// Every input the env block reads, owned, so a table row is one value.
+    pub(crate) struct Case {
+        pub name: &'static str,
+        pub project: Project,
+        pub global_aws: GlobalAwsSettings,
+        pub global_ollama: GlobalOllamaSettings,
+        pub global_llamacpp: GlobalLlamaCppSettings,
+        pub global_openai: GlobalOpenAiCompatibleSettings,
+        pub global_instructions: Option<&'static str>,
+        pub global_env: Vec<EnvVar>,
+        pub timezone: Option<&'static str>,
+        pub global_cc: Option<ClaudeCodeSettings>,
+        pub default_git_name: Option<&'static str>,
+        pub default_git_email: Option<&'static str>,
+        pub ca: Option<ResolvedCa>,
+        pub shared_token: Option<(String, String)>,
+    }
+
+    fn case(name: &'static str, project: Project) -> Case {
+        Case {
+            name,
+            project,
+            global_aws: GlobalAwsSettings::default(),
+            global_ollama: GlobalOllamaSettings::default(),
+            global_llamacpp: GlobalLlamaCppSettings::default(),
+            global_openai: GlobalOpenAiCompatibleSettings::default(),
+            global_instructions: None,
+            global_env: Vec::new(),
+            timezone: None,
+            global_cc: None,
+            default_git_name: None,
+            default_git_email: None,
+            ca: None,
+            shared_token: None,
+        }
+    }
+
+    fn proj(backend: Backend) -> Project {
+        let mut p = Project::new("demo".to_string(), Vec::new());
+        p.backend = backend;
+        p
+    }
+
+    fn bedrock(method: BedrockAuthMethod) -> BedrockConfig {
+        BedrockConfig {
+            auth_method: method,
+            aws_region: "us-east-1".into(),
+            aws_access_key_id: Some("AKIAFAKE".into()),
+            aws_secret_access_key: Some("secretfake".into()),
+            aws_session_token: None,
+            aws_profile: Some("proj-profile".into()),
+            aws_bearer_token: Some("bearerfake".into()),
+            model_id: Some("anthropic.claude-x".into()),
+            disable_prompt_caching: true,
+            service_tier: Some(" priority ".into()),
+        }
+    }
+
+    pub(crate) fn cases() -> Vec<Case> {
+        let mut v = Vec::new();
+
+        let mut c = case("anthropic_shared_token", proj(Backend::Anthropic));
+        c.shared_token = Some(("sk-shared-token".into(), "v7".into()));
+        v.push(c);
+
+        v.push(case("anthropic_plain", proj(Backend::Anthropic)));
+
+        let mut p = proj(Backend::Bedrock);
+        p.bedrock_config = Some(bedrock(BedrockAuthMethod::StaticCredentials));
+        let mut c = case("bedrock_static_keys", p);
+        c.global_aws.default_model_id = Some("global-model".into());
+        v.push(c);
+
+        let mut p = proj(Backend::Bedrock);
+        let mut b = bedrock(BedrockAuthMethod::Profile);
+        b.aws_region = String::new();
+        b.aws_profile = None;
+        b.model_id = None;
+        b.disable_prompt_caching = false;
+        b.service_tier = Some("  ".into());
+        p.bedrock_config = Some(b);
+        let mut c = case("bedrock_profile_global_fallbacks", p);
+        c.global_aws.aws_region = Some("eu-west-1".into());
+        c.global_aws.aws_profile = Some("global-profile".into());
+        c.global_aws.default_model_id = Some("global-model".into());
+        v.push(c);
+
+        let mut p = proj(Backend::Bedrock);
+        p.bedrock_config = Some(bedrock(BedrockAuthMethod::BearerToken));
+        v.push(case("bedrock_bearer", p));
+
+        let mut p = proj(Backend::Ollama);
+        p.ollama_config = Some(OllamaConfig {
+            base_url: "http://ollama.local:11434".into(),
+            model_id: Some("qwen3".into()),
+            haiku_model_id: None,
+        });
+        let mut c = case("ollama", p);
+        c.global_ollama.default_haiku_model_id = Some("tiny".into());
+        v.push(c);
+
+        let mut p = proj(Backend::LlamaCpp);
+        p.llamacpp_config = Some(LlamaCppConfig {
+            base_url: String::new(),
+            model_id: None,
+            haiku_model_id: Some("llama-small".into()),
+        });
+        let mut c = case("llamacpp_global_url", p);
+        c.global_llamacpp.base_url = Some("http://llama:8080".into());
+        c.global_llamacpp.default_model_id = Some("llama-big".into());
+        v.push(c);
+
+        let mut p = proj(Backend::OpenAiCompatible);
+        p.openai_compatible_config = Some(OpenAiCompatibleConfig {
+            base_url: "https://gw.example/v1".into(),
+            api_key: Some("sk-gateway".into()),
+            model_id: Some("gpt-x".into()),
+            haiku_model_id: Some("gpt-mini".into()),
+        });
+        v.push(case("openai_compatible", p));
+
+        let mut p = proj(Backend::Anthropic);
+        p.custom_env_vars = vec![
+            EnvVar { key: "FOO".into(), value: "project".into() },
+            EnvVar { key: "  SPACED ".into(), value: "x y".into() },
+            EnvVar { key: "".into(), value: "dropped".into() },
+            EnvVar { key: "HOME".into(), value: "reserved".into() },
+            EnvVar { key: "CLAUDE_CODE_OAUTH_TOKEN".into(), value: "reserved".into() },
+        ];
+        let mut c = case("custom_env", p);
+        c.global_env = vec![
+            EnvVar { key: "FOO".into(), value: "global".into() },
+            EnvVar { key: "BAR".into(), value: "b".into() },
+        ];
+        v.push(c);
+
+        let mut p = proj(Backend::Anthropic);
+        p.claude_instructions = Some("project rules".into());
+        p.mission_control_enabled = true;
+        p.sandbox_mode_enabled = true;
+        p.port_mappings = vec![PortMapping {
+            host_port: 8080,
+            container_port: 3000,
+            protocol: "tcp".into(),
+        }];
+        let mut c = case("instructions_and_mission_control", p);
+        c.global_instructions = Some("global rules\nline two");
+        v.push(c);
+
+        let mut p = proj(Backend::Anthropic);
+        p.claude_code_settings = Some(ClaudeCodeSettings {
+            effort: Some("high".into()),
+            focus_mode: Some(false),
+            ..Default::default()
+        });
+        let mut c = case("claude_code_settings", p);
+        c.global_cc = Some(ClaudeCodeSettings {
+            tui_mode: Some("fullscreen".into()),
+            env_scrub: Some(true),
+            prompt_caching_1h: Some(true),
+            ..Default::default()
+        });
+        v.push(c);
+
+        let mut p = proj(Backend::Anthropic);
+        p.vpn_support_enabled = true;
+        p.git_token = Some("ghp_faketoken".into());
+        p.git_user_name = Some("Project User".into());
+        let mut c = case("vpn_git_timezone", p);
+        c.timezone = Some("Europe/Berlin");
+        c.default_git_name = Some("Default Name");
+        c.default_git_email = Some("default@example.com");
+        v.push(c);
+
+        let mut c = case("corporate_ca", proj(Backend::Anthropic));
+        c.ca = Some(ResolvedCa {
+            host_path: "/certs".into(),
+            is_dir: true,
+            mount_target: "/tmp/.host-ca".into(),
+            cert_files: vec![PathBuf::from("/certs/a.crt")],
+        });
+        v.push(c);
+
+        v
+    }
+
+    fn golden_path(name: &str) -> PathBuf {
+        PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("src/docker/workspace_env_golden")
+            .join(format!("{name}.txt"))
+    }
+
+    /// `merge_custom_env_vars` collects a `HashMap`, so the custom variables
+    /// come out in a different order every run (before the extraction as
+    /// well). Sort that one run — between the last managed blank and the
+    /// fingerprint — so the rest of the order is still compared exactly.
+    fn normalise(mut env: Vec<String>) -> Vec<String> {
+        let end = env.iter().position(|e| e.starts_with("TRIPLE_C_CUSTOM_ENV=")).unwrap();
+        let start = env.iter().position(|e| e.starts_with("CLAUDE_CODE_OAUTH_TOKEN=")).unwrap() + 1;
+        env[start..end].sort();
+        env
+    }
+
+    /// The pre-refactor block's output, recorded before the extraction (see
+    /// `workspace_env_golden/`), must be reproduced exactly, order included.
+    #[test]
+    fn workspace_env_matches_what_create_container_built_before_the_extraction() {
+        for c in cases() {
+            let inputs = super::WorkspaceEnvInputs {
+                global_aws: &c.global_aws,
+                global_ollama: &c.global_ollama,
+                global_llamacpp: &c.global_llamacpp,
+                global_openai_compatible: &c.global_openai,
+                global_claude_instructions: c.global_instructions,
+                global_custom_env_vars: &c.global_env,
+                timezone: c.timezone,
+                global_claude_code_settings: c.global_cc.as_ref(),
+                default_git_user_name: c.default_git_name,
+                default_git_user_email: c.default_git_email,
+                resolved_ca: c.ca.as_ref(),
+                shared_claude_token: c.shared_token.as_ref().map(|(t, _)| t.as_str()),
+            };
+            let got: Vec<String> = super::workspace_env(&c.project, &inputs)
+                .into_iter()
+                .map(|(k, v)| format!("{k}={v}"))
+                .collect();
+            let want = std::fs::read_to_string(golden_path(c.name)).unwrap();
+            let want: Vec<String> = want
+                .lines()
+                .filter(|l| *l != "[" && *l != "]")
+                .map(|l| {
+                    let l = l.trim().trim_end_matches(',');
+                    serde_json::from_str::<String>(l).unwrap_or_else(|_| panic!("{l}"))
+                })
+                .collect();
+            assert_eq!(normalise(got), normalise(want), "case {}", c.name);
+        }
+    }
+}

app/src-tauri/src/docker/workspace_env_golden/anthropic_plain.txt

@@ -0,0 +1,33 @@
+[
+    "NODE_EXTRA_CA_CERTS=",
+    "REQUESTS_CA_BUNDLE=",
+    "SSL_CERT_FILE=",
+    "CLAUDE_CODE_USE_BEDROCK=",
+    "AWS_REGION=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_PROFILE=",
+    "AWS_BEARER_TOKEN_BEDROCK=",
+    "AWS_SSO_AUTH_REFRESH_CMD=",
+    "ANTHROPIC_BASE_URL=",
+    "ANTHROPIC_AUTH_TOKEN=",
+    "ANTHROPIC_MODEL=",
+    "DISABLE_PROMPT_CACHING=",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=",
+    "CLAUDE_CODE_OAUTH_TOKEN=",
+    "TRIPLE_C_CUSTOM_ENV=",
+    "VPN_SUPPORT_ENABLED=0",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened.",
+    "CLAUDE_CODE_NO_FLICKER=",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0",
+    "ENABLE_PROMPT_CACHING_1H=0",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"sandbox\":{\"enabled\":false},\"showThinkingSummaries\":false}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"effortLevel\",\"tui\",\"viewMode\"]",
+]

app/src-tauri/src/docker/workspace_env_golden/anthropic_shared_token.txt

@@ -0,0 +1,33 @@
+[
+    "CLAUDE_CODE_OAUTH_TOKEN=sk-shared-token",
+    "NODE_EXTRA_CA_CERTS=",
+    "REQUESTS_CA_BUNDLE=",
+    "SSL_CERT_FILE=",
+    "CLAUDE_CODE_USE_BEDROCK=",
+    "AWS_REGION=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_PROFILE=",
+    "AWS_BEARER_TOKEN_BEDROCK=",
+    "AWS_SSO_AUTH_REFRESH_CMD=",
+    "ANTHROPIC_BASE_URL=",
+    "ANTHROPIC_AUTH_TOKEN=",
+    "ANTHROPIC_MODEL=",
+    "DISABLE_PROMPT_CACHING=",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=",
+    "TRIPLE_C_CUSTOM_ENV=",
+    "VPN_SUPPORT_ENABLED=0",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened.",
+    "CLAUDE_CODE_NO_FLICKER=",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0",
+    "ENABLE_PROMPT_CACHING_1H=0",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"sandbox\":{\"enabled\":false},\"showThinkingSummaries\":false}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"effortLevel\",\"tui\",\"viewMode\"]",
+]

app/src-tauri/src/docker/workspace_env_golden/bedrock_bearer.txt

@@ -0,0 +1,33 @@
+[
+    "CLAUDE_CODE_USE_BEDROCK=1",
+    "AWS_REGION=us-east-1",
+    "AWS_BEARER_TOKEN_BEDROCK=bearerfake",
+    "ANTHROPIC_MODEL=anthropic.claude-x",
+    "DISABLE_PROMPT_CACHING=1",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=priority",
+    "NODE_EXTRA_CA_CERTS=",
+    "REQUESTS_CA_BUNDLE=",
+    "SSL_CERT_FILE=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_PROFILE=",
+    "AWS_SSO_AUTH_REFRESH_CMD=",
+    "ANTHROPIC_BASE_URL=",
+    "ANTHROPIC_AUTH_TOKEN=",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=",
+    "CLAUDE_CODE_OAUTH_TOKEN=",
+    "TRIPLE_C_CUSTOM_ENV=",
+    "VPN_SUPPORT_ENABLED=0",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened.",
+    "CLAUDE_CODE_NO_FLICKER=",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0",
+    "ENABLE_PROMPT_CACHING_1H=0",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"sandbox\":{\"enabled\":false},\"showThinkingSummaries\":false}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"effortLevel\",\"tui\",\"viewMode\"]",
+]

app/src-tauri/src/docker/workspace_env_golden/bedrock_profile_global_fallbacks.txt

@@ -0,0 +1,33 @@
+[
+    "CLAUDE_CODE_USE_BEDROCK=1",
+    "AWS_REGION=eu-west-1",
+    "AWS_PROFILE=global-profile",
+    "AWS_SSO_AUTH_REFRESH_CMD=triple-c-sso-refresh",
+    "ANTHROPIC_MODEL=global-model",
+    "NODE_EXTRA_CA_CERTS=",
+    "REQUESTS_CA_BUNDLE=",
+    "SSL_CERT_FILE=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_BEARER_TOKEN_BEDROCK=",
+    "ANTHROPIC_BASE_URL=",
+    "ANTHROPIC_AUTH_TOKEN=",
+    "DISABLE_PROMPT_CACHING=",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=",
+    "CLAUDE_CODE_OAUTH_TOKEN=",
+    "TRIPLE_C_CUSTOM_ENV=",
+    "VPN_SUPPORT_ENABLED=0",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened.",
+    "CLAUDE_CODE_NO_FLICKER=",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0",
+    "ENABLE_PROMPT_CACHING_1H=0",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"sandbox\":{\"enabled\":false},\"showThinkingSummaries\":false}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"effortLevel\",\"tui\",\"viewMode\"]",
+]

app/src-tauri/src/docker/workspace_env_golden/bedrock_static_keys.txt

@@ -0,0 +1,33 @@
+[
+    "CLAUDE_CODE_USE_BEDROCK=1",
+    "AWS_REGION=us-east-1",
+    "ANTHROPIC_MODEL=anthropic.claude-x",
+    "DISABLE_PROMPT_CACHING=1",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=priority",
+    "NODE_EXTRA_CA_CERTS=",
+    "REQUESTS_CA_BUNDLE=",
+    "SSL_CERT_FILE=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_PROFILE=",
+    "AWS_BEARER_TOKEN_BEDROCK=",
+    "AWS_SSO_AUTH_REFRESH_CMD=",
+    "ANTHROPIC_BASE_URL=",
+    "ANTHROPIC_AUTH_TOKEN=",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=",
+    "CLAUDE_CODE_OAUTH_TOKEN=",
+    "TRIPLE_C_CUSTOM_ENV=",
+    "VPN_SUPPORT_ENABLED=0",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened.",
+    "CLAUDE_CODE_NO_FLICKER=",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0",
+    "ENABLE_PROMPT_CACHING_1H=0",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"sandbox\":{\"enabled\":false},\"showThinkingSummaries\":false}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"effortLevel\",\"tui\",\"viewMode\"]",
+]

app/src-tauri/src/docker/workspace_env_golden/claude_code_settings.txt

@@ -0,0 +1,33 @@
+[
+    "NODE_EXTRA_CA_CERTS=",
+    "REQUESTS_CA_BUNDLE=",
+    "SSL_CERT_FILE=",
+    "CLAUDE_CODE_USE_BEDROCK=",
+    "AWS_REGION=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_PROFILE=",
+    "AWS_BEARER_TOKEN_BEDROCK=",
+    "AWS_SSO_AUTH_REFRESH_CMD=",
+    "ANTHROPIC_BASE_URL=",
+    "ANTHROPIC_AUTH_TOKEN=",
+    "ANTHROPIC_MODEL=",
+    "DISABLE_PROMPT_CACHING=",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=",
+    "CLAUDE_CODE_OAUTH_TOKEN=",
+    "TRIPLE_C_CUSTOM_ENV=",
+    "VPN_SUPPORT_ENABLED=0",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened.",
+    "CLAUDE_CODE_NO_FLICKER=1",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1",
+    "ENABLE_PROMPT_CACHING_1H=1",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"effortLevel\":\"high\",\"sandbox\":{\"enabled\":false},\"showThinkingSummaries\":false,\"tui\":\"fullscreen\"}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"viewMode\"]",
+]

app/src-tauri/src/docker/workspace_env_golden/corporate_ca.txt

@@ -0,0 +1,33 @@
+[
+    "NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt",
+    "REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt",
+    "SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt",
+    "CLAUDE_CODE_USE_BEDROCK=",
+    "AWS_REGION=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_PROFILE=",
+    "AWS_BEARER_TOKEN_BEDROCK=",
+    "AWS_SSO_AUTH_REFRESH_CMD=",
+    "ANTHROPIC_BASE_URL=",
+    "ANTHROPIC_AUTH_TOKEN=",
+    "ANTHROPIC_MODEL=",
+    "DISABLE_PROMPT_CACHING=",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=",
+    "CLAUDE_CODE_OAUTH_TOKEN=",
+    "TRIPLE_C_CUSTOM_ENV=",
+    "VPN_SUPPORT_ENABLED=0",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened.",
+    "CLAUDE_CODE_NO_FLICKER=",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0",
+    "ENABLE_PROMPT_CACHING_1H=0",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"sandbox\":{\"enabled\":false},\"showThinkingSummaries\":false}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"effortLevel\",\"tui\",\"viewMode\"]",
+]

app/src-tauri/src/docker/workspace_env_golden/custom_env.txt

@@ -0,0 +1,37 @@
+[
+    "NODE_EXTRA_CA_CERTS=",
+    "REQUESTS_CA_BUNDLE=",
+    "SSL_CERT_FILE=",
+    "CLAUDE_CODE_USE_BEDROCK=",
+    "AWS_REGION=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_PROFILE=",
+    "AWS_BEARER_TOKEN_BEDROCK=",
+    "AWS_SSO_AUTH_REFRESH_CMD=",
+    "ANTHROPIC_BASE_URL=",
+    "ANTHROPIC_AUTH_TOKEN=",
+    "ANTHROPIC_MODEL=",
+    "DISABLE_PROMPT_CACHING=",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=",
+    "CLAUDE_CODE_OAUTH_TOKEN=",
+    "BAR=b",
+    "FOO=project",
+    "SPACED=x y",
+    "HOME=reserved",
+    "TRIPLE_C_CUSTOM_ENV=63ce864a8c48a386cb039d4878e3885d5a823d4bb52047ba0e18cb87b9f3035b",
+    "VPN_SUPPORT_ENABLED=0",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened.",
+    "CLAUDE_CODE_NO_FLICKER=",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0",
+    "ENABLE_PROMPT_CACHING_1H=0",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"sandbox\":{\"enabled\":false},\"showThinkingSummaries\":false}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"effortLevel\",\"tui\",\"viewMode\"]",
+]

app/src-tauri/src/docker/workspace_env_golden/instructions_and_mission_control.txt

@@ -0,0 +1,34 @@
+[
+    "NODE_EXTRA_CA_CERTS=",
+    "REQUESTS_CA_BUNDLE=",
+    "SSL_CERT_FILE=",
+    "CLAUDE_CODE_USE_BEDROCK=",
+    "AWS_REGION=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_PROFILE=",
+    "AWS_BEARER_TOKEN_BEDROCK=",
+    "AWS_SSO_AUTH_REFRESH_CMD=",
+    "ANTHROPIC_BASE_URL=",
+    "ANTHROPIC_AUTH_TOKEN=",
+    "ANTHROPIC_MODEL=",
+    "DISABLE_PROMPT_CACHING=",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=",
+    "CLAUDE_CODE_OAUTH_TOKEN=",
+    "TRIPLE_C_CUSTOM_ENV=",
+    "MISSION_CONTROL_ENABLED=1",
+    "VPN_SUPPORT_ENABLED=0",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=global rules\nline two\n\n## Mission Control\n\nThe `/workspace/mission-control/` directory contains **Flight Control** — an AI-first development methodology for structured project management. Use it for all project work.\n\n### How It Works\n\n- **Mission Control is a tool, not a project.** It provides skills and methodology for managing other projects.\n- All Flight Control skills are installed as personal skills in `~/.claude/skills/` and are automatically available as `/slash-commands`\n- The methodology docs and project registry live in `/workspace/mission-control/`\n\n### When to Use\n\nWhen working on any project that has a `.flightops/` directory, follow the Flight Control methodology:\n1. Read the project's `.flightops/ARTIFACTS.md` to understand artifact storage\n2. Read `.flightops/FLIGHT_OPERATIONS.md` for the implementation workflow\n3. Use Mission Control skills for planning and execution\n\n### Available Skills\n\n| Skill | When to Use |\n|-------|-------------|\n| `/init-project` | Setting up a new project for Flight Control |\n| `/mission` | Defining new work outcomes (days-to-weeks scope) |\n| `/flight` | Creating technical specs from missions (hours-to-days scope) |\n| `/leg` | Generating implementation steps from flights (minutes-to-hours scope) |\n| `/agentic-workflow` | Executing legs with multi-agent workflow (implement, review, commit) |\n| `/flight-debrief` | Post-flight analysis after a flight lands |\n| `/mission-debrief` | Post-mission retrospective after completion |\n| `/daily-briefing` | Cross-project status report |\n\n### Key Rules\n\n- **Planning skills produce artifacts only** — never modify source code directly\n- **Phase gates require human confirmation** — missions before flights, flights before legs\n- **Legs are immutable once in-flight** — create new ones instead of modifying\n- **`/agentic-workflow` orchestrates implementation** — it spawns separate Developer and Reviewer agents\n- **Artifacts live in the target project** — not in mission-control\n\nproject rules\n\n## Flight Operations\n\nThis project uses **Flight Control** (bundled with Triple-C) for structured development.\n\n**Before any mission/flight/leg work, read these files in order:**\n1. `.flightops/README.md` — What the flightops directory contains\n2. `.flightops/FLIGHT_OPERATIONS.md` — **The workflow you MUST follow**\n3. `.flightops/ARTIFACTS.md` — Where all artifacts are stored\n4. `.flightops/agent-crews/` — Project crew definitions for each phase (read the relevant crew file)\n\n## Available Port Mappings\nThe following ports are mapped from the host to this container. Use these container ports when starting services that need to be accessible from the host:\n- Host port 8080 -> Container port 3000 (tcp)\n\n## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relLine truncated
+    "CLAUDE_CODE_NO_FLICKER=",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0",
+    "ENABLE_PROMPT_CACHING_1H=0",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"sandbox\":{\"allowUnsandboxedCommands\":false,\"enableWeakerNestedSandbox\":true,\"enabled\":true},\"showThinkingSummaries\":false}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"effortLevel\",\"tui\",\"viewMode\"]",
+]

app/src-tauri/src/docker/workspace_env_golden/llamacpp_global_url.txt

@@ -0,0 +1,33 @@
+[
+    "ANTHROPIC_BASE_URL=http://llama:8080",
+    "ANTHROPIC_AUTH_TOKEN=llama.cpp",
+    "ANTHROPIC_MODEL=llama-big",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=llama-big",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=llama-big",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=llama-small",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=llama-big",
+    "NODE_EXTRA_CA_CERTS=",
+    "REQUESTS_CA_BUNDLE=",
+    "SSL_CERT_FILE=",
+    "CLAUDE_CODE_USE_BEDROCK=",
+    "AWS_REGION=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_PROFILE=",
+    "AWS_BEARER_TOKEN_BEDROCK=",
+    "AWS_SSO_AUTH_REFRESH_CMD=",
+    "DISABLE_PROMPT_CACHING=",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=",
+    "CLAUDE_CODE_OAUTH_TOKEN=",
+    "TRIPLE_C_CUSTOM_ENV=",
+    "VPN_SUPPORT_ENABLED=0",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened.",
+    "CLAUDE_CODE_NO_FLICKER=",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0",
+    "ENABLE_PROMPT_CACHING_1H=0",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"sandbox\":{\"enabled\":false},\"showThinkingSummaries\":false}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"effortLevel\",\"tui\",\"viewMode\"]",
+]

app/src-tauri/src/docker/workspace_env_golden/ollama.txt

@@ -0,0 +1,33 @@
+[
+    "ANTHROPIC_BASE_URL=http://ollama.local:11434",
+    "ANTHROPIC_AUTH_TOKEN=ollama",
+    "ANTHROPIC_MODEL=qwen3",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=qwen3",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=qwen3",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=tiny",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=qwen3",
+    "NODE_EXTRA_CA_CERTS=",
+    "REQUESTS_CA_BUNDLE=",
+    "SSL_CERT_FILE=",
+    "CLAUDE_CODE_USE_BEDROCK=",
+    "AWS_REGION=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_PROFILE=",
+    "AWS_BEARER_TOKEN_BEDROCK=",
+    "AWS_SSO_AUTH_REFRESH_CMD=",
+    "DISABLE_PROMPT_CACHING=",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=",
+    "CLAUDE_CODE_OAUTH_TOKEN=",
+    "TRIPLE_C_CUSTOM_ENV=",
+    "VPN_SUPPORT_ENABLED=0",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened.",
+    "CLAUDE_CODE_NO_FLICKER=",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0",
+    "ENABLE_PROMPT_CACHING_1H=0",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"sandbox\":{\"enabled\":false},\"showThinkingSummaries\":false}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"effortLevel\",\"tui\",\"viewMode\"]",
+]

app/src-tauri/src/docker/workspace_env_golden/openai_compatible.txt

@@ -0,0 +1,33 @@
+[
+    "ANTHROPIC_BASE_URL=https://gw.example/v1",
+    "ANTHROPIC_AUTH_TOKEN=sk-gateway",
+    "ANTHROPIC_MODEL=gpt-x",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=gpt-x",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=gpt-x",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=gpt-mini",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=gpt-x",
+    "NODE_EXTRA_CA_CERTS=",
+    "REQUESTS_CA_BUNDLE=",
+    "SSL_CERT_FILE=",
+    "CLAUDE_CODE_USE_BEDROCK=",
+    "AWS_REGION=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_PROFILE=",
+    "AWS_BEARER_TOKEN_BEDROCK=",
+    "AWS_SSO_AUTH_REFRESH_CMD=",
+    "DISABLE_PROMPT_CACHING=",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=",
+    "CLAUDE_CODE_OAUTH_TOKEN=",
+    "TRIPLE_C_CUSTOM_ENV=",
+    "VPN_SUPPORT_ENABLED=0",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened.",
+    "CLAUDE_CODE_NO_FLICKER=",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0",
+    "ENABLE_PROMPT_CACHING_1H=0",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"sandbox\":{\"enabled\":false},\"showThinkingSummaries\":false}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"effortLevel\",\"tui\",\"viewMode\"]",
+]

app/src-tauri/src/docker/workspace_env_golden/vpn_git_timezone.txt

@@ -0,0 +1,37 @@
+[
+    "GIT_TOKEN=ghp_faketoken",
+    "GIT_USER_NAME=Project User",
+    "GIT_USER_EMAIL=default@example.com",
+    "NODE_EXTRA_CA_CERTS=",
+    "REQUESTS_CA_BUNDLE=",
+    "SSL_CERT_FILE=",
+    "CLAUDE_CODE_USE_BEDROCK=",
+    "AWS_REGION=",
+    "AWS_ACCESS_KEY_ID=",
+    "AWS_SECRET_ACCESS_KEY=",
+    "AWS_SESSION_TOKEN=",
+    "AWS_PROFILE=",
+    "AWS_BEARER_TOKEN_BEDROCK=",
+    "AWS_SSO_AUTH_REFRESH_CMD=",
+    "ANTHROPIC_BASE_URL=",
+    "ANTHROPIC_AUTH_TOKEN=",
+    "ANTHROPIC_MODEL=",
+    "DISABLE_PROMPT_CACHING=",
+    "ANTHROPIC_BEDROCK_SERVICE_TIER=",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL=",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL=",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL=",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL=",
+    "CLAUDE_CODE_OAUTH_TOKEN=",
+    "TRIPLE_C_CUSTOM_ENV=",
+    "TZ=Europe/Berlin",
+    "VPN_SUPPORT_ENABLED=1",
+    "TRIPLE_C_PERMISSION_MODE=default",
+    "CLAUDE_INSTRUCTIONS=## Scheduled Tasks\n\nThis container supports scheduled tasks via `triple-c-scheduler`. You can set up recurring or one-time tasks that run as separate Claude Code agents.\n\n### Commands\n- `triple-c-scheduler add --name \"NAME\" --schedule \"CRON\" --prompt \"TASK\"` — Add a recurring task\n- `triple-c-scheduler add --name \"NAME\" --at \"YYYY-MM-DD HH:MM\" --prompt \"TASK\"` — Add a one-time task\n- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column\n- `triple-c-scheduler remove --id ID` — Remove a task\n- `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks\n- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long\n- `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs\n- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)\n- `triple-c-scheduler notifications [--clear]` — View or clear completion notifications\n\n### Cron format\nStandard 5-field cron: `minute hour day-of-month month day-of-week`\nExamples: `*/30 * * * *` (every 30 min), `0 9 * * 1-5` (9am weekdays), `0 */2 * * *` (every 2 hours)\n\n### One-time tasks\nUse `--at \"YYYY-MM-DD HH:MM\"` instead of `--schedule`. The task automatically removes itself after execution.\n\n### Working directory\nUse `--working-dir /workspace/project` to set where the task runs (default: /workspace).\n\n### Checking results\nWhile a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.\n\n### Timezone\nScheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used.\n\n## Referring to files\n\nThe user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened.",
+    "CLAUDE_CODE_NO_FLICKER=",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY=",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0",
+    "ENABLE_PROMPT_CACHING_1H=0",
+    "CLAUDE_CODE_SETTINGS_JSON={\"autoScrollEnabled\":true,\"sandbox\":{\"enabled\":false},\"showThinkingSummaries\":false}",
+    "CLAUDE_CODE_SETTINGS_CLEAR=[\"awaySummaryEnabled\",\"effortLevel\",\"tui\",\"viewMode\"]",
+]

app/src-tauri/src/file_viewer/poll.rs

@@ -7,7 +7,7 @@
 
 use serde::Serialize;
 
-use crate::docker::exec::exec_oneshot_streams_as;
+use crate::host::ContainerTarget;
 
 #[derive(Clone, Debug, Serialize, PartialEq, Eq)]
 pub struct ViewerPoll {
@@ -40,7 +40,10 @@ pub fn parse_poll_output(code: i64, stdout: &str) -> ViewerPoll {
     ViewerPoll { exists: true, hash, size }
 }
 
-pub async fn poll_file(container_id: &str, container_path: &str) -> Result<ViewerPoll, String> {
+pub async fn poll_file(
+    container: &ContainerTarget,
+    container_path: &str,
+) -> Result<ViewerPoll, String> {
     let cmd = vec![
         "sh".to_string(),
         "-c".to_string(),
@@ -48,8 +51,11 @@ pub async fn poll_file(container_id: &str, container_path: &str) -> Result<Viewe
         "poll".to_string(),
         container_path.to_string(),
     ];
-    let (stdout, stderr, code) =
-        exec_oneshot_streams_as(container_id, "claude", cmd, Vec::new()).await?;
+    // A background poll: an open viewer must not keep an idle AWS workspace
+    // up. Opening and saving a file are the user's own actions and count.
+    let (stdout, stderr, code) = container
+        .exec_oneshot_streams_background("claude", cmd)
+        .await?;
     if code != 0 && code != 4 {
         return Err(format!(
             "Could not check the file: {}",

app/src-tauri/src/file_viewer/resolve.rs

@@ -10,8 +10,8 @@
 //! hold the resolved path, not the one that was clicked.
 
 use crate::commands::file_commands::validate_container_path;
-use crate::docker::exec::exec_oneshot_streams_as;
 use crate::docker::CONTAINER_HOME;
+use crate::host::ContainerTarget;
 
 pub const MAX_CANDIDATES: usize = 16;
 const MAX_RAW_LEN: usize = 4096;
@@ -131,13 +131,14 @@ pub fn parse_probe_output(stdout: &str) -> Vec<String> {
 }
 
 pub async fn probe_candidates(
-    container_id: &str,
+    container: &ContainerTarget,
     candidates: &[String],
 ) -> Result<Vec<String>, String> {
     let mut cmd: Vec<String> = vec!["sh".into(), "-c".into(), PROBE_SCRIPT.into(), "probe".into()];
     cmd.extend(candidates.iter().cloned());
-    let (stdout, _stderr, _code) =
-        exec_oneshot_streams_as(container_id, "claude", cmd, Vec::new()).await?;
+    let (stdout, _stderr, _code) = container
+        .exec_oneshot_streams_as("claude", cmd, Vec::new())
+        .await?;
     Ok(parse_probe_output(&stdout))
 }
 

app/src-tauri/src/file_viewer/write.rs

@@ -11,7 +11,7 @@ use serde::Serialize;
 use sha2::{Digest, Sha256};
 
 use crate::commands::file_commands::clip_container_text;
-use crate::docker::exec::{exec_oneshot_streams_as, ExecSessionManager};
+use crate::host::{ContainerTarget, ExecSessionManager};
 
 /// Spec §4/§5: only untruncated (≤ 1 MiB) text is editable, so nothing larger is saved.
 pub const MAX_WRITE_BYTES: usize = 1024 * 1024;
@@ -172,7 +172,7 @@ fn saved_file(outcome: WriteOutcome, bytes: &[u8]) -> Result<SavedFile, String>
 }
 
 pub async fn write_file(
-    container_id: &str,
+    container: &ContainerTarget,
     exec_manager: &ExecSessionManager,
     target: &str,
     bytes: &[u8],
@@ -181,11 +181,12 @@ pub async fn write_file(
     check_write_input(bytes.len(), base_hash)?;
     let tmp_name = format!("triple-c-viewer-{}", uuid::Uuid::new_v4().simple());
     let tmp_path = exec_manager
-        .write_file_to_container(container_id, &tmp_name, bytes)
+        .write_file_to_container(container, &tmp_name, bytes)
         .await?;
     let cmd = write_command(target, &tmp_path, base_hash);
-    let (stdout, stderr, code) =
-        exec_oneshot_streams_as(container_id, "claude", cmd, Vec::new()).await?;
+    let (stdout, stderr, code) = container
+        .exec_oneshot_streams_as("claude", cmd, Vec::new())
+        .await?;
     saved_file(classify_write(code, &stdout, &stderr), bytes)
 }
 

app/src-tauri/src/host/agent.rs

@@ -0,0 +1,953 @@
+//! The app's side of `triple-c-agent`, the small server that runs inside a
+//! project container and does over HTTP what the Docker variant does through
+//! the Docker API.
+//!
+//! Wire protocol: `docs/superpowers/specs/2026-11-13-triple-c-agent-protocol.md`.
+//! Its "Client mapping" table is what this file implements, one function per
+//! [`ContainerTarget`](super::ContainerTarget) method. The contract is Docker
+//! parity: every function here returns exactly what its `docker/exec.rs`
+//! counterpart returns for the same command, including the shape of one-shot
+//! output (combined in arrival order, or stdout/stderr split), the
+//! `OUTPUT_LIMIT` refusal text, and the path an upload reports.
+//!
+//! The token never leaves this file except as the `Authorization` header:
+//! [`AgentEndpoint`]'s `Debug` redacts it and no error string is built from a
+//! request (reqwest and tungstenite errors name the URL, which carries no
+//! secret, never the headers).
+
+use std::collections::{HashMap, VecDeque};
+use std::io;
+use std::pin::Pin;
+use std::sync::{Mutex, OnceLock};
+use std::task::{Context, Poll};
+use std::time::Duration;
+
+use base64::Engine;
+use bytes::Bytes;
+use futures_util::{SinkExt, StreamExt};
+use serde::Deserialize;
+use tokio::io::AsyncWrite;
+use tokio_tungstenite::tungstenite::client::IntoClientRequest;
+use tokio_tungstenite::tungstenite::http::HeaderValue;
+use crate::host::OUTPUT_LIMIT_MARKER;
+use tokio_tungstenite::tungstenite::Message;
+use tokio_util::sync::PollSender;
+
+use super::{ArchiveStream, AttachedExec, ExecChunk, ExecSpec};
+use crate::docker::exec::{
+    container_join, output_limit_error, parse_user_ids, read_host_file_for_upload, user_ids_cmd,
+    OneshotOutput, EXEC_EXIT_POLLS, EXEC_EXIT_POLL_INTERVAL, HOST_FILE_UPLOAD_MODE,
+    MAX_ONESHOT_OUTPUT, USER_IDS_OUTPUT_LIMIT,
+};
+
+/// Connecting (TCP, and the WebSocket handshake) must not hang a caller on an
+/// agent that is not there. Nothing else has an overall timeout: a one-shot
+/// exec, an attach or an archive download can legitimately run for minutes.
+const CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
+/// `is_running` is a liveness probe; it answers quickly or says "no".
+const HEALTH_TIMEOUT: Duration = Duration::from_secs(3);
+/// Whole-request ceiling for the small calls (detached start, exec status,
+/// resize) and for reading any small body. The agent is not trusted: one that
+/// accepts a connection and then says nothing must not hang the app. One-shot
+/// execs, attach and archive have *no* overall timeout — commands can
+/// legitimately run long and send nothing until they finish, as with Docker.
+#[cfg(not(test))]
+const SMALL_REQUEST_TIMEOUT: Duration = Duration::from_secs(15);
+/// Short in tests, so the hostile-agent tests finish quickly.
+#[cfg(test)]
+const SMALL_REQUEST_TIMEOUT: Duration = Duration::from_secs(1);
+/// Largest WebSocket message either side may send; the agent enforces the same
+/// (its output frames are at most 32 KiB). Stdin is split to fit.
+const WS_MAX_MESSAGE: usize = 1024 * 1024;
+const STDIN_FRAME_MAX: usize = 64 * 1024;
+/// How long an attach waits for the agent's `started` reply after the
+/// handshake. Spawning a process is fast; this only bounds a wedged agent.
+const ATTACH_START_TIMEOUT: Duration = Duration::from_secs(30);
+/// In-flight stdin frames per attach before `poll_write` applies backpressure.
+const STDIN_QUEUE: usize = 64;
+
+/// Where an agent listens and the bearer token it wants.
+///
+/// `base_url` is `http://127.0.0.1:<port>/`: the local end of an SSM
+/// port-forward on AWS, or a published loopback port in the local harness.
+#[derive(Clone, PartialEq, Eq, Hash)]
+pub struct AgentEndpoint {
+    pub base_url: url::Url,
+    token: String,
+}
+
+impl std::fmt::Debug for AgentEndpoint {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("AgentEndpoint")
+            .field("base_url", &self.base_url.as_str())
+            .field("token", &"<redacted>")
+            .finish()
+    }
+}
+
+impl AgentEndpoint {
+    /// An endpoint at `base_url`, which must be a plain `http://` URL with a
+    /// host. A trailing `/` is added so endpoint paths join beneath it.
+    pub fn new(mut base_url: url::Url, token: impl Into<String>) -> Result<Self, String> {
+        if base_url.scheme() != "http" || base_url.host().is_none() {
+            return Err(format!(
+                "An agent endpoint must be an http:// URL with a host, not {}",
+                base_url
+            ));
+        }
+        if !base_url.path().ends_with('/') {
+            let path = format!("{}/", base_url.path());
+            base_url.set_path(&path);
+        }
+        base_url.set_query(None);
+        base_url.set_fragment(None);
+        let token = token.into();
+        // It goes in an HTTP header; refuse anything that cannot, here, once,
+        // rather than failing (or silently degrading) on every request.
+        if token.is_empty() || !token.bytes().all(|b| b.is_ascii_graphic()) {
+            return Err("An agent token must be non-empty printable ASCII with no spaces".to_string());
+        }
+        Ok(Self {
+            base_url,
+            token,
+        })
+    }
+
+    /// The agent on `127.0.0.1:<port>`.
+    pub fn loopback(port: u16, token: impl Into<String>) -> Self {
+        let url = url::Url::parse(&format!("http://127.0.0.1:{}/", port))
+            .expect("a loopback URL always parses");
+        Self::new(url, token).expect("a loopback URL is a valid endpoint")
+    }
+
+    fn url(&self, path: &str) -> url::Url {
+        self.base_url
+            .join(path)
+            .expect("endpoint paths are fixed relative paths")
+    }
+
+    fn ws_url(&self, path: &str) -> url::Url {
+        let mut u = self.url(path);
+        u.set_scheme("ws").expect("http -> ws is a valid scheme change");
+        u
+    }
+
+    fn bearer(&self) -> String {
+        format!("Bearer {}", self.token)
+    }
+
+    /// The `Authorization` header, marked sensitive so it is never logged or
+    /// shown by `Debug` (reqwest/hyper honour the flag).
+    fn auth(&self) -> HeaderValue {
+        let mut v = HeaderValue::from_str(&self.bearer())
+            .unwrap_or_else(|_| HeaderValue::from_static("Bearer invalid-token"));
+        v.set_sensitive(true);
+        v
+    }
+}
+
+// ── HTTP plumbing ────────────────────────────────────────────────────────────
+
+/// One client for every agent: connection pooling is per host, and building a
+/// client per call would redo TLS-less setup for nothing. No proxy — the agent
+/// is always on loopback, and a corporate `HTTP_PROXY` must not capture it.
+fn http() -> &'static reqwest::Client {
+    static CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
+    CLIENT.get_or_init(|| {
+        reqwest::Client::builder()
+            .connect_timeout(CONNECT_TIMEOUT)
+            .no_proxy()
+            // The agent lives inside the container, which is not trusted with
+            // the host: a redirect would let it point this client — running in
+            // the host app — at any other URL. A 3xx is an error (it fails the
+            // `is_success` checks like any other non-2xx).
+            .redirect(reqwest::redirect::Policy::none())
+            .build()
+            .expect("a reqwest client with no TLS config always builds")
+    })
+}
+
+#[derive(Deserialize)]
+struct ErrorBody {
+    error: String,
+}
+
+/// Ceiling on any small JSON body from the agent (errors, exec ids, exec
+/// status). The agent is inside the container, so a body it sends must not be
+/// able to grow host memory without bound; real ones are tens of bytes.
+const SMALL_BODY_CAP: usize = 64 * 1024;
+
+/// Ceiling on error text passed through to the UI.
+const ERROR_TEXT_CAP: usize = 4 * 1024;
+
+/// Parse a small JSON body, reading at most [`SMALL_BODY_CAP`] bytes.
+async fn small_json<T: serde::de::DeserializeOwned>(resp: reqwest::Response) -> Option<T> {
+    let raw = tokio::time::timeout(SMALL_REQUEST_TIMEOUT, read_capped(resp, SMALL_BODY_CAP))
+        .await
+        .ok()?
+        .ok()??;
+    serde_json::from_slice(&raw).ok()
+}
+
+/// The agent's `{"error": …}` text, if the body has one — bounded in both
+/// bytes read and length returned.
+async fn error_text(resp: reqwest::Response) -> Option<String> {
+    let mut e = small_json::<ErrorBody>(resp).await?.error;
+    if e.len() > ERROR_TEXT_CAP {
+        let mut cut = ERROR_TEXT_CAP;
+        while !e.is_char_boundary(cut) {
+            cut -= 1;
+        }
+        e.truncate(cut);
+        e.push('…');
+    }
+    Some(e)
+}
+
+/// `"<context>: <why>"` for a non-success response.
+async fn status_error(context: &str, resp: reqwest::Response) -> String {
+    let status = resp.status();
+    if status == reqwest::StatusCode::UNAUTHORIZED {
+        return format!("{}: the agent rejected the credentials (401)", context);
+    }
+    match error_text(resp).await {
+        Some(e) => format!("{}: {}", context, e),
+        None => format!("{}: agent returned HTTP {}", context, status.as_u16()),
+    }
+}
+
+async fn send(
+    context: &str,
+    req: reqwest::RequestBuilder,
+) -> Result<reqwest::Response, String> {
+    req.send().await.map_err(|e| format!("{}: {}", context, e))
+}
+
+/// Read a response body into memory, refusing past `cap` bytes.
+async fn read_capped(mut resp: reqwest::Response, cap: usize) -> Result<Option<Vec<u8>>, String> {
+    let mut body = Vec::new();
+    while let Some(chunk) = resp
+        .chunk()
+        .await
+        .map_err(|e| format!("Exec output error: {}", e))?
+    {
+        if body.len() + chunk.len() > cap {
+            return Ok(None);
+        }
+        body.extend_from_slice(&chunk);
+    }
+    Ok(Some(body))
+}
+
+/// ExecSpec as the protocol spells it.
+fn spec_json(spec: &ExecSpec) -> serde_json::Map<String, serde_json::Value> {
+    let v = serde_json::json!({
+        "cmd": spec.cmd,
+        "user": spec.user,
+        "working_dir": spec.working_dir,
+        "env": spec.env,
+        "tty": spec.tty,
+    });
+    match v {
+        serde_json::Value::Object(m) => m,
+        _ => unreachable!("json! of an object literal is an object"),
+    }
+}
+
+// ── one-shot execs ───────────────────────────────────────────────────────────
+
+#[derive(Deserialize)]
+struct OneshotChunk {
+    s: String,
+    d: String,
+}
+
+#[derive(Deserialize)]
+struct OneshotResponse {
+    chunks: Vec<OneshotChunk>,
+    exit_code: i64,
+}
+
+/// `POST /v1/exec`, reassembled into the same [`OneshotOutput`] the Docker
+/// path builds. Like Docker's one-shot, there is no tty, stdin is empty, and
+/// the working directory is the container's default.
+async fn exec_oneshot_raw(
+    ep: &AgentEndpoint,
+    user: &str,
+    cmd: Vec<String>,
+    env: Vec<String>,
+    limit: usize,
+) -> Result<OneshotOutput, String> {
+    exec_oneshot_raw_marked(ep, user, cmd, env, limit, false).await
+}
+
+/// The agent's background marker (protocol spec, "Activity"): a request that
+/// carries it never counts as activity for idle stop.
+pub const BACKGROUND_HEADER: &str = "X-Triple-C-Background";
+
+async fn exec_oneshot_raw_marked(
+    ep: &AgentEndpoint,
+    user: &str,
+    cmd: Vec<String>,
+    env: Vec<String>,
+    limit: usize,
+    background: bool,
+) -> Result<OneshotOutput, String> {
+    const CONTEXT: &str = "Failed to start exec";
+    let spec = ExecSpec::new(cmd).user(user).working_dir(None).env(env).tty(false);
+    let mut body = spec_json(&spec);
+    body.insert("limit".into(), serde_json::json!(limit));
+
+    let mut req = http()
+        .post(ep.url("v1/exec"))
+        .header(reqwest::header::AUTHORIZATION, ep.auth())
+        .json(&body);
+    if background {
+        req = req.header(BACKGROUND_HEADER, "1");
+    }
+    let resp = send(CONTEXT, req).await?;
+
+    let status = resp.status();
+    if status == reqwest::StatusCode::PAYLOAD_TOO_LARGE {
+        // Verbatim when it is the limit message (callers match on
+        // OUTPUT_LIMIT_MARKER); anything else the agent puts in a 413 is not
+        // trusted to speak for it.
+        return Err(error_text(resp)
+            .await
+            .filter(|e| e.starts_with(OUTPUT_LIMIT_MARKER))
+            .unwrap_or_else(|| output_limit_error(limit)));
+    }
+    if !status.is_success() {
+        return Err(status_error(CONTEXT, resp).await);
+    }
+
+    // The agent enforces `limit`, but this is container-controlled input
+    // being buffered into the host, so the client bounds it too: base64 is
+    // 4/3 of the payload and each chunk carries a few bytes of JSON, so a
+    // body past this is over the limit however it was chunked.
+    let cap = limit.saturating_mul(8).saturating_add(64 * 1024);
+    let raw = read_capped(resp, cap)
+        .await?
+        .ok_or_else(|| output_limit_error(limit))?;
+    let parsed: OneshotResponse = serde_json::from_slice(&raw)
+        .map_err(|e| format!("Exec output error: malformed agent response: {}", e))?;
+
+    let mut out = OneshotOutput::new();
+    let b64 = base64::engine::general_purpose::STANDARD;
+    for chunk in parsed.chunks {
+        let from_stdout = match chunk.s.as_str() {
+            "out" => true,
+            "err" => false,
+            other => {
+                return Err(format!(
+                    "Exec output error: unknown stream {:?} in agent response",
+                    other
+                ))
+            }
+        };
+        let bytes = b64
+            .decode(chunk.d.as_bytes())
+            .map_err(|e| format!("Exec output error: bad base64 from agent: {}", e))?;
+        out.push(from_stdout, &bytes, limit)?;
+    }
+    out.exit_code = parsed.exit_code;
+    Ok(out)
+}
+
+/// Combined output and exit code under `limit` — `exec_oneshot_limited` and,
+/// with [`MAX_ONESHOT_OUTPUT`], every other combined-output variant.
+pub async fn exec_oneshot_limited(
+    ep: &AgentEndpoint,
+    user: &str,
+    cmd: Vec<String>,
+    env: Vec<String>,
+    limit: usize,
+) -> Result<(String, i64), String> {
+    let out = exec_oneshot_raw(ep, user, cmd, env, limit).await?;
+    Ok((out.text(), out.exit_code))
+}
+
+/// [`exec_oneshot_limited`] marked as a background poll, so it never keeps
+/// an idle workspace up (the auth bridge's `/proc/net` reads).
+pub async fn exec_oneshot_background(
+    ep: &AgentEndpoint,
+    user: &str,
+    cmd: Vec<String>,
+    limit: usize,
+) -> Result<(String, i64), String> {
+    let out = exec_oneshot_raw_marked(ep, user, cmd, Vec::new(), limit, true).await?;
+    Ok((out.text(), out.exit_code))
+}
+
+/// `exec_oneshot_as`: combined output under [`MAX_ONESHOT_OUTPUT`].
+pub async fn exec_oneshot_as(
+    ep: &AgentEndpoint,
+    user: &str,
+    cmd: Vec<String>,
+    env: Vec<String>,
+) -> Result<(String, i64), String> {
+    exec_oneshot_limited(ep, user, cmd, env, MAX_ONESHOT_OUTPUT).await
+}
+
+/// `exec_oneshot_streams_as`: `(stdout, stderr, exit_code)`.
+pub async fn exec_oneshot_streams_as(
+    ep: &AgentEndpoint,
+    user: &str,
+    cmd: Vec<String>,
+    env: Vec<String>,
+) -> Result<(String, String, i64), String> {
+    let out = exec_oneshot_raw(ep, user, cmd, env, MAX_ONESHOT_OUTPUT).await?;
+    Ok((out.stdout(), out.stderr(), out.exit_code))
+}
+
+/// [`exec_oneshot_streams_as`] marked as a background poll (the file
+/// viewer's change check), so it never keeps an idle workspace up.
+pub async fn exec_oneshot_streams_background(
+    ep: &AgentEndpoint,
+    user: &str,
+    cmd: Vec<String>,
+) -> Result<(String, String, i64), String> {
+    let out = exec_oneshot_raw_marked(ep, user, cmd, Vec::new(), MAX_ONESHOT_OUTPUT, true).await?;
+    Ok((out.stdout(), out.stderr(), out.exit_code))
+}
+
+// ── detached execs, status, resize ───────────────────────────────────────────
+
+#[derive(Deserialize)]
+struct ExecIdResponse {
+    exec_id: String,
+}
+
+pub async fn exec_detached(ep: &AgentEndpoint, spec: &ExecSpec) -> Result<String, String> {
+    const CONTEXT: &str = "Failed to start exec";
+    let resp = send(
+        CONTEXT,
+        http()
+            .post(ep.url("v1/exec/detached"))
+            .timeout(SMALL_REQUEST_TIMEOUT)
+            .header(reqwest::header::AUTHORIZATION, ep.auth())
+            .json(&spec_json(spec)),
+    )
+    .await?;
+    if !resp.status().is_success() {
+        return Err(status_error(CONTEXT, resp).await);
+    }
+    small_json::<ExecIdResponse>(resp)
+        .await
+        .map(|r| r.exec_id)
+        .ok_or_else(|| format!("{}: malformed agent response", CONTEXT))
+}
+
+#[derive(Deserialize)]
+struct ExecStatus {
+    running: bool,
+    exit_code: Option<i64>,
+}
+
+/// Exit codes attach streams saw in their `exit` frame, so `wait_exec_exit`
+/// can answer without a round trip. Bounded: a long-running app opens many
+/// sessions, and the agent keeps the same answer for ten minutes anyway.
+struct ExitBook {
+    codes: HashMap<(String, String), i64>,
+    order: VecDeque<(String, String)>,
+}
+
+const EXIT_BOOK_CAP: usize = 256;
+
+fn exit_book() -> &'static Mutex<ExitBook> {
+    static BOOK: OnceLock<Mutex<ExitBook>> = OnceLock::new();
+    BOOK.get_or_init(|| {
+        Mutex::new(ExitBook {
+            codes: HashMap::new(),
+            order: VecDeque::new(),
+        })
+    })
+}
+
+fn record_exit(base_url: &str, exec_id: &str, code: i64) {
+    let key = (base_url.to_string(), exec_id.to_string());
+    let mut book = exit_book().lock().unwrap_or_else(|p| p.into_inner());
+    if book.codes.insert(key.clone(), code).is_none() {
+        book.order.push_back(key);
+        while book.order.len() > EXIT_BOOK_CAP {
+            if let Some(old) = book.order.pop_front() {
+                book.codes.remove(&old);
+            }
+        }
+    }
+}
+
+fn recorded_exit(base_url: &str, exec_id: &str) -> Option<i64> {
+    let book = exit_book().lock().unwrap_or_else(|p| p.into_inner());
+    book.codes
+        .get(&(base_url.to_string(), exec_id.to_string()))
+        .copied()
+}
+
+/// Poll `GET /v1/exec/{id}` with Docker's budget. `None` on any error, an
+/// unknown id, a finished exec with no code, or the budget running out —
+/// exactly where `docker::exec::wait_for_exec_exit` says `None`.
+pub async fn wait_exec_exit(ep: &AgentEndpoint, exec_id: &str) -> Option<i64> {
+    // Docker's budget is a number of polls; bound the wall clock too, so a
+    // slow-answering agent cannot stretch it (each poll is also bounded).
+    let budget = EXEC_EXIT_POLL_INTERVAL * EXEC_EXIT_POLLS as u32 + SMALL_REQUEST_TIMEOUT;
+    tokio::time::timeout(budget, wait_exec_exit_polls(ep, exec_id)).await.ok()?
+}
+
+async fn wait_exec_exit_polls(ep: &AgentEndpoint, exec_id: &str) -> Option<i64> {
+    if let Some(code) = recorded_exit(ep.base_url.as_str(), exec_id) {
+        return Some(code);
+    }
+    let url = ep.url(&format!("v1/exec/{}", urlencode_segment(exec_id)));
+    for _ in 0..EXEC_EXIT_POLLS {
+        if let Some(code) = recorded_exit(ep.base_url.as_str(), exec_id) {
+            return Some(code);
+        }
+        let resp = http()
+            .get(url.clone())
+            .timeout(SMALL_REQUEST_TIMEOUT)
+            .header(reqwest::header::AUTHORIZATION, ep.auth())
+            .send()
+            .await
+            .ok()?;
+        if !resp.status().is_success() {
+            return None;
+        }
+        let status: ExecStatus = small_json(resp).await?;
+        if !status.running {
+            return status.exit_code;
+        }
+        tokio::time::sleep(EXEC_EXIT_POLL_INTERVAL).await;
+    }
+    None
+}
+
+pub async fn resize_exec(ep: &AgentEndpoint, exec_id: &str, cols: u16, rows: u16) -> Result<(), String> {
+    const CONTEXT: &str = "Failed to resize exec";
+    let resp = send(
+        CONTEXT,
+        http()
+            .post(ep.url(&format!("v1/exec/{}/resize", urlencode_segment(exec_id))))
+            .timeout(SMALL_REQUEST_TIMEOUT)
+            .header(reqwest::header::AUTHORIZATION, ep.auth())
+            .json(&serde_json::json!({ "cols": cols, "rows": rows })),
+    )
+    .await?;
+    if !resp.status().is_success() {
+        return Err(status_error(CONTEXT, resp).await);
+    }
+    Ok(())
+}
+
+/// Exec ids come from the agent; escape them anyway so one can never turn
+/// into a different path.
+fn urlencode_segment(s: &str) -> String {
+    url::form_urlencoded::byte_serialize(s.as_bytes()).collect()
+}
+
+// ── attach ───────────────────────────────────────────────────────────────────
+
+type Ws = tokio_tungstenite::WebSocketStream<
+    tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>,
+>;
+
+#[derive(Deserialize)]
+struct ControlFrame {
+    #[serde(rename = "type")]
+    kind: String,
+    exec_id: Option<String>,
+    code: Option<i64>,
+    error: Option<String>,
+}
+
+/// What the stdin writer hands the socket task.
+enum StdinCmd {
+    Data(Bytes),
+    Close,
+}
+
+/// Open `GET /v1/attach` and authenticate. Shared by attach (and, later,
+/// tunnels).
+async fn connect_ws(ep: &AgentEndpoint, path: &str, context: &str) -> Result<Ws, String> {
+    let mut req = ep
+        .ws_url(path)
+        .as_str()
+        .into_client_request()
+        .map_err(|e| format!("{}: {}", context, e))?;
+    let auth = ep.auth();
+    req.headers_mut()
+        .insert(tokio_tungstenite::tungstenite::http::header::AUTHORIZATION, auth);
+    let config = tokio_tungstenite::tungstenite::protocol::WebSocketConfig::default()
+        .max_message_size(Some(WS_MAX_MESSAGE))
+        .max_frame_size(Some(WS_MAX_MESSAGE));
+    match tokio::time::timeout(
+        CONNECT_TIMEOUT,
+        tokio_tungstenite::connect_async_with_config(req, Some(config), false),
+    )
+    .await
+    {
+        Err(_) => Err(format!("{}: timed out connecting to the agent", context)),
+        Ok(Err(tokio_tungstenite::tungstenite::Error::Http(resp)))
+            if resp.status() == tokio_tungstenite::tungstenite::http::StatusCode::UNAUTHORIZED =>
+        {
+            Err(format!("{}: the agent rejected the credentials (401)", context))
+        }
+        Ok(Err(e)) => Err(format!("{}: {}", context, e)),
+        Ok(Ok((ws, _))) => Ok(ws),
+    }
+}
+
+/// `GET /v1/attach`: the same [`AttachedExec`] Docker hands back.
+///
+/// Output: channel 1 → [`ExecChunk::StdOut`], 2 → [`ExecChunk::StdErr`]; the
+/// `exit` frame ends the stream and is remembered for [`wait_exec_exit`].
+/// Input: each write is one binary frame; `shutdown` sends `close_stdin`.
+/// Dropping both halves closes the socket.
+pub async fn attach(ep: &AgentEndpoint, spec: &ExecSpec) -> Result<AttachedExec, String> {
+    const CONTEXT: &str = "Failed to start exec";
+    let mut ws = connect_ws(ep, "v1/attach", CONTEXT).await?;
+
+    let mut hello = spec_json(spec);
+    hello.insert("attach_stdin".into(), serde_json::json!(spec.attach_stdin));
+    let hello = serde_json::Value::Object(hello).to_string();
+    ws.send(Message::text(hello))
+        .await
+        .map_err(|e| format!("{}: {}", CONTEXT, e))?;
+
+    let exec_id = match tokio::time::timeout(ATTACH_START_TIMEOUT, wait_started(&mut ws)).await {
+        Err(_) => return Err(format!("{}: the agent did not start the command", CONTEXT)),
+        Ok(r) => r.map_err(|e| format!("{}: {}", CONTEXT, e))?,
+    };
+
+    let (mut sink, stream) = ws.split();
+
+    // stdin: a bounded queue drained by one task that owns the socket's write
+    // half. The task ends — dropping the write half — when the writer is
+    // dropped or the socket fails.
+    let (tx, mut rx) = tokio::sync::mpsc::channel::<StdinCmd>(STDIN_QUEUE);
+    tokio::spawn(async move {
+        while let Some(cmd) = rx.recv().await {
+            let msg = match cmd {
+                StdinCmd::Data(b) => Message::binary(b),
+                StdinCmd::Close => Message::text(r#"{"type":"close_stdin"}"#),
+            };
+            if sink.send(msg).await.is_err() {
+                break;
+            }
+        }
+    });
+
+    let base_url = ep.base_url.as_str().to_string();
+    let id_for_stream = exec_id.clone();
+    let output = futures_util::stream::unfold(Some(stream), move |state| {
+        let base_url = base_url.clone();
+        let exec_id = id_for_stream.clone();
+        async move {
+            let mut stream = state?;
+            loop {
+                match stream.next().await? {
+                    Err(e) => return Some((Err(format!("Exec output error: {}", e)), None)),
+                    Ok(Message::Binary(b)) => {
+                        if b.is_empty() {
+                            continue;
+                        }
+                        let payload = b.slice(1..);
+                        let chunk = match b[0] {
+                            1 => ExecChunk::StdOut(payload),
+                            2 => ExecChunk::StdErr(payload),
+                            _ => ExecChunk::Other(payload),
+                        };
+                        return Some((Ok(chunk), Some(stream)));
+                    }
+                    Ok(Message::Text(t)) => {
+                        let frame: ControlFrame = match serde_json::from_str(t.as_str()) {
+                            Ok(f) => f,
+                            Err(_) => continue,
+                        };
+                        match frame.kind.as_str() {
+                            "exit" => {
+                                if let Some(code) = frame.code {
+                                    record_exit(&base_url, &exec_id, code);
+                                }
+                                return None;
+                            }
+                            "error" => {
+                                let e = frame.error.unwrap_or_else(|| "agent error".into());
+                                return Some((Err(format!("Exec output error: {}", e)), None));
+                            }
+                            _ => continue,
+                        }
+                    }
+                    Ok(Message::Close(_)) => return None,
+                    Ok(_) => continue,
+                }
+            }
+        }
+    });
+
+    Ok(AttachedExec {
+        exec_id,
+        output: Box::pin(output),
+        input: Box::pin(AttachInput {
+            tx: PollSender::new(tx),
+            close_sent: false,
+        }),
+    })
+}
+
+/// Read until the agent says `started` (its exec id) or `error`.
+async fn wait_started(ws: &mut Ws) -> Result<String, String> {
+    while let Some(msg) = ws.next().await {
+        match msg.map_err(|e| e.to_string())? {
+            Message::Text(t) => {
+                let frame: ControlFrame = serde_json::from_str(t.as_str())
+                    .map_err(|e| format!("malformed agent frame: {}", e))?;
+                match frame.kind.as_str() {
+                    "started" => {
+                        return frame
+                            .exec_id
+                            .ok_or_else(|| "agent sent no exec id".to_string())
+                    }
+                    "error" => {
+                        return Err(frame.error.unwrap_or_else(|| "agent error".into()))
+                    }
+                    _ => continue,
+                }
+            }
+            Message::Close(_) => break,
+            _ => continue,
+        }
+    }
+    Err("the agent closed the connection before starting the command".to_string())
+}
+
+/// An attach's stdin.
+struct AttachInput {
+    tx: PollSender<StdinCmd>,
+    close_sent: bool,
+}
+
+fn broken_pipe() -> io::Error {
+    io::Error::new(io::ErrorKind::BrokenPipe, "agent connection closed")
+}
+
+impl AsyncWrite for AttachInput {
+    fn poll_write(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &[u8],
+    ) -> Poll<io::Result<usize>> {
+        let this = self.get_mut();
+        if buf.is_empty() {
+            return Poll::Ready(Ok(0));
+        }
+        if this.close_sent {
+            return Poll::Ready(Err(broken_pipe()));
+        }
+        match this.tx.poll_reserve(cx) {
+            Poll::Pending => Poll::Pending,
+            Poll::Ready(Err(_)) => Poll::Ready(Err(broken_pipe())),
+            Poll::Ready(Ok(())) => {
+                // One frame per write, at most STDIN_FRAME_MAX; `write_all`
+                // loops for the rest. Keeps every frame under the agent's
+                // WebSocket message limit.
+                let n = buf.len().min(STDIN_FRAME_MAX);
+                this.tx
+                    .send_item(StdinCmd::Data(Bytes::copy_from_slice(&buf[..n])))
+                    .map_err(|_| broken_pipe())?;
+                Poll::Ready(Ok(n))
+            }
+        }
+    }
+
+    /// Frames are flushed by the socket task as it sends them.
+    fn poll_flush(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Poll::Ready(Ok(()))
+    }
+
+    /// EOF on the child's stdin: `{"type":"close_stdin"}`, once.
+    fn poll_shutdown(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        let this = self.get_mut();
+        if this.close_sent {
+            return Poll::Ready(Ok(()));
+        }
+        match this.tx.poll_reserve(cx) {
+            Poll::Pending => Poll::Pending,
+            Poll::Ready(Err(_)) => Poll::Ready(Err(broken_pipe())),
+            Poll::Ready(Ok(())) => {
+                this.tx.send_item(StdinCmd::Close).map_err(|_| broken_pipe())?;
+                this.close_sent = true;
+                Poll::Ready(Ok(()))
+            }
+        }
+    }
+}
+
+// ── files ────────────────────────────────────────────────────────────────────
+
+/// `(uid, gid)` of `claude`, falling back to `(1000, 1000)` — the same probe
+/// and parse as Docker's `container_user_ids`.
+pub async fn user_ids(ep: &AgentEndpoint) -> (u64, u64) {
+    let (out, _) = exec_oneshot_limited(ep, "claude", user_ids_cmd(), Vec::new(), USER_IDS_OUTPUT_LIMIT)
+        .await
+        .unwrap_or_default();
+    parse_user_ids(&out)
+}
+
+/// Split Docker's tar-entry `name` (which may carry a relative directory, as
+/// the terminal drop's `triple-c-drops/<file>` does) into the `dir` and
+/// single-component `name` `PUT /v1/files` takes. Docker's extractor would
+/// put the file at the same place.
+fn split_upload_target(dest_dir: &str, file_name: &str) -> Result<(String, String), String> {
+    let parts: Vec<&str> = file_name.split('/').filter(|p| !p.is_empty()).collect();
+    let Some((name, parents)) = parts.split_last() else {
+        return Err(format!("Failed to upload file to container: empty file name {:?}", file_name));
+    };
+    if parts.iter().any(|p| *p == "." || *p == "..") {
+        return Err(format!(
+            "Failed to upload file to container: {:?} is not a plain relative name",
+            file_name
+        ));
+    }
+    let mut dir = dest_dir.trim_end_matches('/').to_string();
+    for p in parents {
+        dir.push('/');
+        dir.push_str(p);
+    }
+    if dir.is_empty() {
+        dir.push('/');
+    }
+    Ok((dir, name.to_string()))
+}
+
+async fn put_file(
+    ep: &AgentEndpoint,
+    dest_dir: &str,
+    file_name: &str,
+    data: Vec<u8>,
+    mode: u32,
+    (uid, gid): (u64, u64),
+) -> Result<(), String> {
+    const CONTEXT: &str = "Failed to upload file to container";
+    let (dir, name) = split_upload_target(dest_dir, file_name)?;
+    let mut url = ep.url("v1/files");
+    url.query_pairs_mut()
+        .append_pair("dir", &dir)
+        .append_pair("name", &name)
+        .append_pair("mode", &format!("{:o}", mode))
+        .append_pair("uid", &uid.to_string())
+        .append_pair("gid", &gid.to_string());
+    // Generous, but finite: a minute plus 256 KiB/s for the payload.
+    let timeout = Duration::from_secs(60 + (data.len() as u64) / (256 * 1024));
+    let resp = send(
+        CONTEXT,
+        http()
+            .put(url)
+            .timeout(timeout)
+            .header(reqwest::header::AUTHORIZATION, ep.auth())
+            .header(reqwest::header::CONTENT_TYPE, "application/octet-stream")
+            .body(data),
+    )
+    .await?;
+    if !resp.status().is_success() {
+        return Err(status_error(CONTEXT, resp).await);
+    }
+    Ok(())
+}
+
+/// Docker's `upload_bytes_with_ids`: same reported path.
+pub async fn upload_bytes_with_ids(
+    ep: &AgentEndpoint,
+    dest_dir: &str,
+    file_name: &str,
+    data: &[u8],
+    mode: u32,
+    ids: (u64, u64),
+) -> Result<String, String> {
+    put_file(ep, dest_dir, file_name, data.to_vec(), mode, ids).await?;
+    Ok(format!("{}/{}", dest_dir.trim_end_matches('/'), file_name))
+}
+
+/// Docker's `upload_host_file_with_ids`: the host file is read (and checked)
+/// by the same function, mode 0644, same reported path.
+pub async fn upload_host_file_with_ids(
+    ep: &AgentEndpoint,
+    host_path: &str,
+    dest_dir: &str,
+    dest_name: &str,
+    ids: (u64, u64),
+) -> Result<String, String> {
+    let path = host_path.to_string();
+    let data = tokio::task::spawn_blocking(move || read_host_file_for_upload(&path))
+        .await
+        .map_err(|e| format!("Upload task panicked: {}", e))??;
+    put_file(ep, dest_dir, dest_name, data, HOST_FILE_UPLOAD_MODE, ids).await?;
+    Ok(container_join(dest_dir, dest_name))
+}
+
+/// `GET /v1/archive`, streamed. Dropping the stream drops the response,
+/// which closes the connection and cancels the read on the agent.
+pub fn download_archive(ep: &AgentEndpoint, path: &str) -> ArchiveStream {
+    const CONTEXT: &str = "Failed to download archive";
+    let mut url = ep.url("v1/archive");
+    url.query_pairs_mut().append_pair("path", path);
+    let req = http()
+        .get(url)
+        .header(reqwest::header::AUTHORIZATION, ep.auth());
+
+    enum State {
+        Start(reqwest::RequestBuilder),
+        Body(reqwest::Response),
+    }
+    Box::pin(futures_util::stream::unfold(
+        Some(State::Start(req)),
+        |state| async move {
+            let mut resp = match state? {
+                State::Start(req) => match req.send().await {
+                    Err(e) => return Some((Err(format!("{}: {}", CONTEXT, e)), None)),
+                    Ok(r) if !r.status().is_success() => {
+                        return Some((Err(status_error(CONTEXT, r).await), None))
+                    }
+                    Ok(r) => r,
+                },
+                State::Body(r) => r,
+            };
+            loop {
+                match resp.chunk().await {
+                    Err(e) => return Some((Err(format!("{}: {}", CONTEXT, e)), None)),
+                    Ok(None) => return None,
+                    Ok(Some(b)) if b.is_empty() => continue,
+                    Ok(Some(b)) => return Some((Ok(b), Some(State::Body(resp)))),
+                }
+            }
+        },
+    ))
+}
+
+// ── state ────────────────────────────────────────────────────────────────────
+
+/// `GET /v1/health` answers → `true`. Can't connect (or times out) → `false`,
+/// the same "not running" an inspect failure gives on Docker. An agent that
+/// answers with an error status is reachable but unusable, which is an
+/// `Err` rather than a quiet `false`.
+pub async fn is_running(ep: &AgentEndpoint) -> Result<bool, String> {
+    let resp = match http()
+        .get(ep.url("v1/health"))
+        .header(reqwest::header::AUTHORIZATION, ep.auth())
+        .timeout(HEALTH_TIMEOUT)
+        .send()
+        .await
+    {
+        Ok(r) => r,
+        Err(_) => return Ok(false),
+    };
+    if !resp.status().is_success() {
+        return Err(status_error("Agent health check failed", resp).await);
+    }
+    Ok(true)
+}
+
+#[cfg(test)]
+mod tests;
+#[cfg(test)]
+mod live_tests;

app/src-tauri/src/host/agent/live_tests.rs

@@ -0,0 +1,265 @@
+//! The real agent against `docker exec`, in one real container: every
+//! operation goes through `ContainerTarget::Docker` and
+//! `ContainerTarget::Agent` on the *same* container and must come back the
+//! same. That is the agent protocol's whole requirement ("Docker parity is the
+//! requirement"), checked end to end rather than against a fake.
+//!
+//! Needs a Docker daemon and an image whose entrypoint starts the agent:
+//! `TRIPLEC_AGENT_E2E_IMAGE`, default `tc-agent-e2e:latest` (the sandbox image
+//! plus this branch's `entrypoint.sh` and `triple-c-agent`).
+
+use super::*;
+use crate::host::{ContainerTarget, ExecChunk, ExecSpec, OUTPUT_LIMIT_MARKER};
+use futures_util::StreamExt;
+use std::process::Command;
+use std::time::Duration;
+use tokio::io::AsyncWriteExt;
+
+fn docker_cli(args: &[&str]) -> String {
+    let out = Command::new("docker").args(args).output().expect("docker cli");
+    assert!(out.status.success(), "docker {:?}: {}", args, String::from_utf8_lossy(&out.stderr));
+    String::from_utf8_lossy(&out.stdout).trim().to_string()
+}
+
+fn sh(script: &str) -> Vec<String> {
+    vec!["sh".into(), "-c".into(), script.into()]
+}
+
+/// Drain an attached exec: (stdout, stderr).
+async fn drain(exec: crate::host::AttachedExec) -> (String, String) {
+    let mut out = exec.output;
+    let (mut o, mut e) = (Vec::new(), Vec::new());
+    let collect = async {
+        while let Some(chunk) = out.next().await {
+            match chunk {
+                Ok(ExecChunk::StdOut(b)) => o.extend_from_slice(&b),
+                Ok(ExecChunk::StdErr(b)) => e.extend_from_slice(&b),
+                Ok(ExecChunk::Other(_)) => {}
+                Err(_) => break,
+            }
+        }
+    };
+    tokio::time::timeout(Duration::from_secs(20), collect).await.expect("attach output ended");
+    (String::from_utf8_lossy(&o).into_owned(), String::from_utf8_lossy(&e).into_owned())
+}
+
+/// Fail with both answers side by side.
+fn same<T: PartialEq + std::fmt::Debug>(what: &str, docker: T, agent: T) -> Result<(), String> {
+    if docker == agent {
+        Ok(())
+    } else {
+        Err(format!("{what} differs\n  docker: {docker:?}\n  agent:  {agent:?}"))
+    }
+}
+
+async fn parity(d: &ContainerTarget, a: &ContainerTarget) -> Result<(), String> {
+    // ── one-shot ─────────────────────────────────────────────────────────────
+    let script = sh("echo out1; echo err1 >&2; echo out2; exit 3");
+    same(
+        "streams + exit code",
+        d.exec_oneshot_streams_as("claude", script.clone(), vec![]).await?,
+        a.exec_oneshot_streams_as("claude", script, vec![]).await?,
+    )?;
+
+    for user in ["claude", "root"] {
+        let env = sh("env | sort");
+        let strip = |s: String| -> String {
+            // `docker exec` inherits the container's configured env, which in
+            // this harness carries the agent's settings (the token included —
+            // the local-harness trade-off entrypoint.sh documents). The agent
+            // never passes its own settings on.
+            s.lines().filter(|l| !l.starts_with("TRIPLEC_AGENT_")).collect::<Vec<_>>().join("\n")
+        };
+        let (de, dc) = d.exec_oneshot_as(user, env.clone(), vec![]).await?;
+        let (ae, ac) = a.exec_oneshot_as(user, env, vec![]).await?;
+        same(&format!("environment as {user}"), (strip(de), dc), (strip(ae), ac))?;
+    }
+
+    same("default working dir", d.exec_oneshot(vec!["pwd".into()]).await?, a.exec_oneshot(vec!["pwd".into()]).await?)?;
+
+    let probe = sh("echo \"$FOO|$HOME|$USER|$(id -un)\"");
+    let env = vec!["FOO=bar".to_string(), "HOME=/tmp".to_string()];
+    same(
+        "env overrides",
+        d.exec_oneshot_env_status(probe.clone(), env.clone()).await?,
+        a.exec_oneshot_env_status(probe, env).await?,
+    )?;
+
+    same("user ids", d.user_ids().await, a.user_ids().await)?;
+
+    // Signal state: an exec starts with nothing ignored or blocked, whatever
+    // the process that launched it had (the entrypoint's supervisor ignores
+    // SIGHUP; that must not turn every exec into `nohup`).
+    let sigs = sh("grep -E '^Sig(Ign|Blk):' /proc/self/status");
+    same("signal dispositions/mask", d.exec_oneshot(sigs.clone()).await?, a.exec_oneshot(sigs).await?)?;
+
+    // Stdio belongs to the exec user, as runc arranges: re-opening it by
+    // name works for a non-root user.
+    let reopen = sh("echo out > /dev/stdout; echo err > /dev/stderr");
+    same(
+        "re-opening stdio by name as claude",
+        d.exec_oneshot_streams_as("claude", reopen.clone(), vec![]).await?,
+        a.exec_oneshot_streams_as("claude", reopen, vec![]).await?,
+    )?;
+
+    let flood = sh("head -c 100000 /dev/zero");
+    let de = d.exec_oneshot_limited("claude", flood.clone(), 1000).await.unwrap_err();
+    let ae = a.exec_oneshot_limited("claude", flood, 1000).await.unwrap_err();
+    if !de.starts_with(OUTPUT_LIMIT_MARKER) {
+        return Err(format!("docker limit error: {de}"));
+    }
+    same("output limit error", de, ae)?;
+
+    let (_, dcode) = d.exec_oneshot_env_status(vec!["no-such-binary-tc".into()], vec![]).await?;
+    let (_, acode) = a.exec_oneshot_env_status(vec!["no-such-binary-tc".into()], vec![]).await?;
+    same("missing binary exit code", dcode, acode)?;
+
+    // ── files ────────────────────────────────────────────────────────────────
+    let ids = d.user_ids().await;
+    d.upload_bytes_with_ids("/tmp", "via-docker.txt", b"hello\n", 0o640, ids).await?;
+    a.upload_bytes_with_ids("/tmp", "via-agent.txt", b"hello\n", 0o640, ids).await?;
+    let stat = |n: &str| sh(&format!("stat -c '%a %u %g %s' /tmp/{n} && cat /tmp/{n}"));
+    same(
+        "uploaded file (mode, owner, size, content)",
+        d.exec_oneshot(stat("via-docker.txt")).await?,
+        a.exec_oneshot(stat("via-agent.txt")).await?,
+    )?;
+
+    d.exec_oneshot(sh("rm -rf /tmp/arch && mkdir -p /tmp/arch/sub && echo x > /tmp/arch/x && echo y > /tmp/arch/sub/y")).await?;
+    let list = |t: &ContainerTarget| {
+        let mut s = t.download_archive("/tmp/arch");
+        async move {
+            let mut bytes = Vec::new();
+            while let Some(c) = s.next().await {
+                bytes.extend_from_slice(&c?);
+            }
+            let mut names: Vec<(String, Vec<u8>)> = tar::Archive::new(&bytes[..])
+                .entries()
+                .map_err(|e| e.to_string())?
+                .map(|e| {
+                    let mut e = e.unwrap();
+                    let name = e.path().unwrap().to_string_lossy().trim_end_matches('/').to_string();
+                    let mut data = Vec::new();
+                    std::io::Read::read_to_end(&mut e, &mut data).unwrap();
+                    (name, data)
+                })
+                .collect();
+            names.sort();
+            Ok::<_, String>(names)
+        }
+    };
+    same("archive members and contents", list(d).await?, list(a).await?)?;
+
+    // ── attached ─────────────────────────────────────────────────────────────
+    for (label, t) in [("docker", d), ("agent", a)] {
+        let mut exec = t.attach_exec(vec!["head".into(), "-n1".into()], false).await?;
+        exec.input.write_all(b"ping\n").await.map_err(|e| e.to_string())?;
+        exec.input.flush().await.map_err(|e| e.to_string())?;
+        let id = exec.exec_id.clone();
+        let (o, e) = drain(exec).await;
+        same(&format!("{label}: attach echo"), ("ping\n".to_string(), String::new()), (o, e))?;
+        same(&format!("{label}: attach exit"), Some(0), t.wait_exec_exit(&id).await)?;
+    }
+
+    let mut sizes = Vec::new();
+    for t in [d, a] {
+        let exec = t
+            .attach(ExecSpec::new(sh("sleep 1; stty size")).tty(true))
+            .await?;
+        t.resize_exec(&exec.exec_id, 100, 40).await?;
+        let (o, _) = drain(exec).await;
+        sizes.push(o.trim().to_string());
+    }
+    same("tty size after resize", sizes[0].clone(), sizes[1].clone())?;
+    same("tty size value", "40 100".to_string(), sizes[1].clone())?;
+
+    // A tty session whose client goes away ends (SIGHUP), as a dropped
+    // `docker exec -t` does. Only checked through the agent: it is the agent's
+    // disconnect handling under test. Nothing else in this fresh container
+    // runs `sleep 600`, so counting exact matches is the probe.
+    let exec = a.attach(ExecSpec::new(vec!["sleep".into(), "600".into()]).tty(true)).await?;
+    tokio::time::sleep(Duration::from_millis(500)).await;
+    let count = sh("pgrep -xfc 'sleep 600' || true");
+    let before = a.exec_oneshot(count.clone()).await?;
+    drop(exec);
+    let mut after = String::new();
+    for _ in 0..40 {
+        tokio::time::sleep(Duration::from_millis(250)).await;
+        after = a.exec_oneshot(count.clone()).await?;
+        if after.trim() == "0" {
+            break;
+        }
+    }
+    same("tty session ends when its client goes away (sleep count before → after)", ("1".to_string(), "0".to_string()), (before.trim().to_string(), after.trim().to_string()))?;
+
+    // ── detached ─────────────────────────────────────────────────────────────
+    let mut codes = Vec::new();
+    for t in [d, a] {
+        let id = t.exec_detached(ExecSpec::new(sh("sleep 0.3; exit 5"))).await?;
+        codes.push(t.wait_exec_exit(&id).await);
+    }
+    same("detached exit code", codes[0], codes[1])?;
+
+    same("is_running", d.is_running().await?, a.is_running().await?)?;
+    Ok(())
+}
+
+#[tokio::test]
+#[ignore = "needs a Docker daemon and an image whose entrypoint starts triple-c-agent (TRIPLEC_AGENT_E2E_IMAGE)"]
+async fn the_agent_answers_exactly_as_docker_exec_does() {
+    let image = std::env::var("TRIPLEC_AGENT_E2E_IMAGE").unwrap_or_else(|_| "tc-agent-e2e:latest".into());
+    let token = format!("{}{}", uuid::Uuid::new_v4().simple(), uuid::Uuid::new_v4().simple());
+    let name = format!("tc-agent-e2e-{}", uuid::Uuid::new_v4().simple());
+    docker_cli(&[
+        "run", "-d", "--name", &name, "-w", "/workspace",
+        "-e", &format!("TRIPLEC_AGENT_TOKEN={token}"),
+        // Docker forwards a published port to the container's own address,
+        // not its loopback, so the harness binds the agent wide *inside* the
+        // container and publishes it to the host's loopback only.
+        "-e", "TRIPLEC_AGENT_ADDR=0.0.0.0:47900",
+        "-p", "127.0.0.1::47900",
+        &image,
+    ]);
+    let outcome = async {
+        let mapped = docker_cli(&["port", &name, "47900/tcp"]);
+        let port: u16 = mapped.lines().next().and_then(|l| l.rsplit(':').next()).and_then(|p| p.parse().ok())
+            .ok_or_else(|| format!("no published port in {mapped:?}"))?;
+        // Two ways in, because where *this test* runs decides which one routes:
+        // on the host (where the app runs) the published loopback port; from
+        // inside another container on the same daemon, the published port is
+        // on the host's loopback, not ours, but the container's bridge address
+        // is reachable.
+        let ip = docker_cli(&["inspect", "-f", "{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}", &name]);
+        let mut candidates = vec![AgentEndpoint::loopback(port, token.clone())];
+        for addr in ip.split_whitespace() {
+            let url = url::Url::parse(&format!("http://{addr}:47900/")).map_err(|e| e.to_string())?;
+            candidates.push(AgentEndpoint::new(url, token.clone())?);
+        }
+        let docker = ContainerTarget::docker(name.clone());
+
+        // The entrypoint starts the agent last, after setup (including a
+        // bounded `claude update`), so health is the readiness signal.
+        let mut agent = None;
+        'wait: for _ in 0..240 {
+            for ep in &candidates {
+                let t = ContainerTarget::Agent(ep.clone());
+                if t.is_running().await.unwrap_or(false) {
+                    agent = Some(t);
+                    break 'wait;
+                }
+            }
+            tokio::time::sleep(Duration::from_millis(500)).await;
+        }
+        let Some(agent) = agent else {
+            return Err(format!("agent never answered on {candidates:?}; logs:\n{}", docker_cli(&["logs", "--tail", "40", &name])));
+        };
+        eprintln!("agent reached at {}", agent.id());
+        parity(&docker, &agent).await
+    }
+    .await;
+    let logs = docker_cli(&["logs", "--tail", "20", &name]);
+    let _ = Command::new("docker").args(["rm", "-f", &name]).output();
+    if let Err(e) = outcome {
+        panic!("{e}\n--- container log tail ---\n{logs}");
+    }
+}

app/src-tauri/src/host/agent/tests.rs

@@ -0,0 +1,708 @@
+//! The agent client against a **fake** agent: a few axum handlers that speak
+//! just enough of the v1 protocol to exercise each client path, and record
+//! what they were sent. It is not the real server (that lives in `agent/`)
+//! and does not try to behave like one beyond the wire shapes.
+
+use super::*;
+use crate::host::{ContainerTarget, OUTPUT_LIMIT_MARKER};
+use axum::extract::ws::{Message as WsMessage, WebSocket, WebSocketUpgrade};
+use axum::extract::{Path, Query, State};
+use axum::http::{HeaderMap, StatusCode};
+use axum::response::{IntoResponse, Response};
+use axum::routing::{get, post, put};
+use axum::{Json, Router};
+use serde_json::{json, Value};
+use std::sync::Arc;
+use tokio::io::AsyncWriteExt;
+
+/// Obviously fake; long enough to be unmistakable in an error string.
+const TOKEN: &str = "fake-agent-token-for-unit-tests-only-0000";
+
+#[derive(Default)]
+struct Seen {
+    auth: Vec<String>,
+    exec_bodies: Vec<Value>,
+    /// The background marker of each `/v1/exec`, if any.
+    exec_background: Vec<Option<String>>,
+    detached_bodies: Vec<Value>,
+    status_polls: u32,
+    resizes: Vec<(String, Value)>,
+    uploads: Vec<(HashMap<String, String>, Vec<u8>)>,
+    attach_hello: Option<Value>,
+    stdin: Vec<u8>,
+    close_stdin: bool,
+}
+
+struct Fake {
+    seen: std::sync::Mutex<Seen>,
+}
+
+type St = State<Arc<Fake>>;
+
+impl Fake {
+    fn authed(&self, h: &HeaderMap) -> bool {
+        let got = h
+            .get("authorization")
+            .and_then(|v| v.to_str().ok())
+            .unwrap_or("")
+            .to_string();
+        let ok = got == format!("Bearer {}", TOKEN);
+        self.seen.lock().unwrap().auth.push(got);
+        ok
+    }
+}
+
+fn unauthorized() -> Response {
+    StatusCode::UNAUTHORIZED.into_response()
+}
+
+fn b64(bytes: &[u8]) -> String {
+    base64::engine::general_purpose::STANDARD.encode(bytes)
+}
+
+async fn exec(State(f): St, h: HeaderMap, Json(body): Json<Value>) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    {
+        let mut seen = f.seen.lock().unwrap();
+        seen.exec_bodies.push(body.clone());
+        seen.exec_background.push(
+            h.get("x-triple-c-background").and_then(|v| v.to_str().ok()).map(str::to_string),
+        );
+    }
+    match body["cmd"][0].as_str().unwrap_or("") {
+        "sh" => Json(json!({"chunks": [{"s": "out", "d": b64(b"1000\n1001\n")}], "exit_code": 0}))
+            .into_response(),
+        // stdout and stderr interleaved; `ü` split across two stdout chunks;
+        // one byte that is not UTF-8 at all on stderr.
+        "mixed" => Json(json!({
+            "chunks": [
+                {"s": "out", "d": b64(b"first ")},
+                {"s": "err", "d": b64(b"find: /x: denied\n")},
+                {"s": "out", "d": b64(&[0xc3])},
+                {"s": "out", "d": b64(&[0xbc, b'!'])},
+                {"s": "err", "d": b64(&[0xff])},
+            ],
+            "exit_code": 3
+        }))
+        .into_response(),
+        "big" => (
+            StatusCode::PAYLOAD_TOO_LARGE,
+            Json(json!({"error": "OUTPUT_LIMIT: Command output exceeded 5 bytes and was abandoned"})),
+        )
+            .into_response(),
+        _ => (StatusCode::INTERNAL_SERVER_ERROR, Json(json!({"error": "boom"}))).into_response(),
+    }
+}
+
+async fn detached(State(f): St, h: HeaderMap, Json(body): Json<Value>) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    f.seen.lock().unwrap().detached_bodies.push(body);
+    Json(json!({"exec_id": "d1"})).into_response()
+}
+
+/// `d1` reports running for two polls, then exit 7. Everything else is 404 —
+/// including the attach's `a1`, so an attach's exit can only have come from
+/// the client's own record of the `exit` frame.
+async fn status(State(f): St, h: HeaderMap, Path(id): Path<String>) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    if id != "d1" {
+        return (StatusCode::NOT_FOUND, Json(json!({"error": "no such exec"}))).into_response();
+    }
+    let mut s = f.seen.lock().unwrap();
+    s.status_polls += 1;
+    if s.status_polls < 3 {
+        Json(json!({"running": true, "exit_code": null})).into_response()
+    } else {
+        Json(json!({"running": false, "exit_code": 7})).into_response()
+    }
+}
+
+async fn resize(State(f): St, h: HeaderMap, Path(id): Path<String>, Json(body): Json<Value>) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    f.seen.lock().unwrap().resizes.push((id, body));
+    StatusCode::NO_CONTENT.into_response()
+}
+
+async fn files(
+    State(f): St,
+    h: HeaderMap,
+    Query(q): Query<HashMap<String, String>>,
+    body: Bytes,
+) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    let path = format!("{}/{}", q["dir"], q["name"]);
+    f.seen.lock().unwrap().uploads.push((q, body.to_vec()));
+    Json(json!({"path": path})).into_response()
+}
+
+async fn archive(State(f): St, h: HeaderMap, Query(q): Query<HashMap<String, String>>) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    if q["path"] == "/missing" {
+        return (StatusCode::NOT_FOUND, Json(json!({"error": "no such path"}))).into_response();
+    }
+    let parts: Vec<Result<Bytes, std::io::Error>> = vec![
+        Ok(Bytes::from_static(b"tar-part-1;")),
+        Ok(Bytes::from_static(b"tar-part-2;")),
+        Ok(Bytes::from(q["path"].clone().into_bytes())),
+    ];
+    axum::body::Body::from_stream(futures_util::stream::iter(parts)).into_response()
+}
+
+async fn health(State(f): St, h: HeaderMap) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    Json(json!({"agent": "triple-c-agent", "version": "0.0.0-fake", "protocol": 1})).into_response()
+}
+
+async fn attach_ws(State(f): St, h: HeaderMap, ws: WebSocketUpgrade) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    ws.on_upgrade(move |socket| fake_attach(f, socket))
+}
+
+/// started → stdout, stderr, an unknown channel → collect stdin until
+/// `close_stdin` → echo it on stdout → exit 5 → close.
+async fn fake_attach(f: Arc<Fake>, mut ws: WebSocket) {
+    let Some(Ok(WsMessage::Text(hello))) = ws.recv().await else { return };
+    let hello: Value = serde_json::from_str(hello.as_str()).unwrap();
+    let refuse = hello["cmd"][0] == "nope";
+    f.seen.lock().unwrap().attach_hello = Some(hello);
+    if refuse {
+        let _ = ws
+            .send(WsMessage::Text(r#"{"type":"error","error":"no such user"}"#.into()))
+            .await;
+        return;
+    }
+    let _ = ws
+        .send(WsMessage::Text(r#"{"type":"started","exec_id":"a1"}"#.into()))
+        .await;
+    for frame in [&b"\x01out"[..], b"\x02err", b"\x09odd"] {
+        let _ = ws.send(WsMessage::Binary(Bytes::copy_from_slice(frame))).await;
+    }
+    while let Some(Ok(msg)) = ws.recv().await {
+        match msg {
+            WsMessage::Binary(b) => f.seen.lock().unwrap().stdin.extend_from_slice(&b),
+            WsMessage::Text(t) if t.as_str().contains("close_stdin") => {
+                f.seen.lock().unwrap().close_stdin = true;
+                break;
+            }
+            _ => {}
+        }
+    }
+    let mut echo = vec![1u8];
+    echo.extend_from_slice(&f.seen.lock().unwrap().stdin);
+    let _ = ws.send(WsMessage::Binary(echo.into())).await;
+    let _ = ws.send(WsMessage::Text(r#"{"type":"exit","code":5}"#.into())).await;
+    let _ = ws.close().await;
+}
+
+async fn fake_agent() -> (AgentEndpoint, Arc<Fake>) {
+    let fake = Arc::new(Fake {
+        seen: std::sync::Mutex::new(Seen::default()),
+    });
+    let app = Router::new()
+        .route("/v1/health", get(health))
+        .route("/v1/exec", post(exec))
+        .route("/v1/exec/detached", post(detached))
+        .route("/v1/exec/{id}", get(status))
+        .route("/v1/exec/{id}/resize", post(resize))
+        .route("/v1/files", put(files))
+        .route("/v1/archive", get(archive))
+        .route("/v1/attach", get(attach_ws))
+        .with_state(fake.clone());
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    tokio::spawn(async move {
+        axum::serve(listener, app).await.unwrap();
+    });
+    (AgentEndpoint::loopback(port, TOKEN), fake)
+}
+
+fn target(ep: &AgentEndpoint) -> ContainerTarget {
+    ContainerTarget::Agent(ep.clone())
+}
+
+fn cmd(c: &str) -> Vec<String> {
+    vec![c.to_string()]
+}
+
+// ── endpoint ─────────────────────────────────────────────────────────────────
+
+#[test]
+fn the_token_never_appears_in_debug_output() {
+    let ep = AgentEndpoint::loopback(47900, TOKEN);
+    let dbg = format!("{:?} {:?}", ep, ContainerTarget::Agent(ep.clone()));
+    assert!(!dbg.contains(TOKEN), "{}", dbg);
+    assert!(dbg.contains("127.0.0.1:47900"));
+    assert!(dbg.contains("redacted"));
+}
+
+#[test]
+fn an_agent_target_is_identified_by_its_base_url() {
+    let a = ContainerTarget::Agent(AgentEndpoint::loopback(47900, TOKEN));
+    assert_eq!(a.id(), "http://127.0.0.1:47900/");
+    assert_eq!(a, ContainerTarget::Agent(AgentEndpoint::loopback(47900, TOKEN)));
+    assert_ne!(a, ContainerTarget::Agent(AgentEndpoint::loopback(47901, TOKEN)));
+    let mut set = std::collections::HashSet::new();
+    set.insert(a.clone());
+    assert!(set.contains(&a));
+}
+
+#[test]
+fn only_plain_http_endpoints_are_accepted() {
+    let ok = AgentEndpoint::new(url::Url::parse("http://127.0.0.1:1/x").unwrap(), TOKEN).unwrap();
+    assert_eq!(ok.base_url.as_str(), "http://127.0.0.1:1/x/");
+    assert_eq!(ok.url("v1/health").as_str(), "http://127.0.0.1:1/x/v1/health");
+    assert_eq!(ok.ws_url("v1/attach").as_str(), "ws://127.0.0.1:1/x/v1/attach");
+    assert!(AgentEndpoint::new(url::Url::parse("https://h/").unwrap(), TOKEN).is_err());
+    assert!(AgentEndpoint::new(url::Url::parse("file:///tmp").unwrap(), TOKEN).is_err());
+}
+
+// ── auth ─────────────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn every_request_carries_the_bearer_token() {
+    let (ep, fake) = fake_agent().await;
+    let t = target(&ep);
+    assert!(t.is_running().await.unwrap());
+    t.exec_oneshot(cmd("sh")).await.unwrap();
+    let auth = fake.seen.lock().unwrap().auth.clone();
+    assert_eq!(auth.len(), 2);
+    assert!(auth.iter().all(|a| a == &format!("Bearer {}", TOKEN)));
+}
+
+#[tokio::test]
+async fn a_wrong_token_is_an_error_that_does_not_carry_any_token() {
+    let (ep, _) = fake_agent().await;
+    let wrong_token = "wrong-fake-token-for-unit-tests-only-1111";
+    let bad = ContainerTarget::Agent(AgentEndpoint::new(ep.base_url.clone(), wrong_token).unwrap());
+
+    let e = bad.exec_oneshot(cmd("sh")).await.unwrap_err();
+    assert!(e.contains("401"), "{}", e);
+    assert!(e.starts_with("Failed to start exec"), "{}", e);
+    let Err(attach_err) = bad.attach(ExecSpec::new(cmd("sh"))).await else {
+        panic!("attach with a wrong token succeeded")
+    };
+    assert!(attach_err.contains("401"), "{}", attach_err);
+    let health_err = bad.is_running().await.unwrap_err();
+    let up_err = bad.upload_bytes("/tmp", "x", b"x", 0o644).await.unwrap_err();
+    for e in [&e, &attach_err, &health_err, &up_err] {
+        assert!(!e.contains(wrong_token) && !e.contains(TOKEN), "{}", e);
+    }
+}
+
+#[tokio::test]
+async fn other_errors_carry_the_agents_message_and_no_token() {
+    let (ep, _) = fake_agent().await;
+    let e = target(&ep).exec_oneshot(cmd("fail")).await.unwrap_err();
+    assert_eq!(e, "Failed to start exec: boom");
+}
+
+#[tokio::test]
+async fn only_a_background_poll_carries_the_background_marker() {
+    let (ep, fake) = fake_agent().await;
+    let t = target(&ep);
+    t.exec_oneshot_limited("claude", cmd("sh"), 1000).await.unwrap();
+    t.exec_oneshot_background("claude", cmd("sh"), 1000).await.unwrap();
+    let seen = fake.seen.lock().unwrap();
+    assert_eq!(seen.exec_background, [None, Some("1".to_string())]);
+    assert_eq!(seen.exec_bodies[0], seen.exec_bodies[1], "the request is otherwise the same");
+}
+
+#[tokio::test]
+async fn the_file_viewers_poll_is_a_background_request_and_its_open_and_save_are_not() {
+    let (ep, fake) = fake_agent().await;
+    let t = target(&ep);
+    // The 2 s change check, as the viewer runs it.
+    let _ = crate::file_viewer::poll::poll_file(&t, "/workspace/x").await;
+    t.exec_oneshot_streams_background("claude", cmd("sh")).await.unwrap();
+    // What opening or saving goes through: user actions, which count.
+    t.exec_oneshot_streams_as("claude", cmd("sh"), Vec::new()).await.unwrap();
+    let seen = fake.seen.lock().unwrap();
+    assert_eq!(seen.exec_background, [Some("1".to_string()), Some("1".to_string()), None]);
+    let src = |s: &str| s.contains("exec_oneshot_streams_as(");
+    assert!(!src(include_str!("../../file_viewer/poll.rs")), "the poll stays a background request");
+    assert!(src(include_str!("../../file_viewer/resolve.rs")) && src(include_str!("../../file_viewer/write.rs")));
+}
+
+// ── one-shot execs ───────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn every_oneshot_variant_reassembles_what_docker_would_return() {
+    let (ep, fake) = fake_agent().await;
+    let t = target(&ep);
+    // Arrival order, `ü` rejoined across chunks, the stray 0xff lossy.
+    let combined = "first find: /x: denied\nü!\u{fffd}";
+    let env = vec!["K=V".to_string()];
+
+    assert_eq!(t.exec_oneshot(cmd("mixed")).await.unwrap(), combined);
+    assert_eq!(t.exec_oneshot_env(cmd("mixed"), env.clone()).await.unwrap(), combined);
+    assert_eq!(
+        t.exec_oneshot_env_status(cmd("mixed"), env.clone()).await.unwrap(),
+        (combined.to_string(), 3)
+    );
+    assert_eq!(
+        t.exec_oneshot_as("root", cmd("mixed"), env.clone()).await.unwrap(),
+        (combined.to_string(), 3)
+    );
+    assert_eq!(
+        t.exec_oneshot_limited("root", cmd("mixed"), 4096).await.unwrap(),
+        (combined.to_string(), 3)
+    );
+    assert_eq!(
+        t.exec_oneshot_streams_as("root", cmd("mixed"), env.clone()).await.unwrap(),
+        ("first ü!".to_string(), "find: /x: denied\n\u{fffd}".to_string(), 3)
+    );
+
+    let bodies = fake.seen.lock().unwrap().exec_bodies.clone();
+    let max = MAX_ONESHOT_OUTPUT as u64;
+    let expect = [
+        ("claude", json!([]), max),
+        ("claude", json!(["K=V"]), max),
+        ("claude", json!(["K=V"]), max),
+        ("root", json!(["K=V"]), max),
+        ("root", json!([]), 4096),
+        ("root", json!(["K=V"]), max),
+    ];
+    assert_eq!(bodies.len(), expect.len());
+    for (b, (user, env, limit)) in bodies.iter().zip(expect) {
+        assert_eq!(b["user"], user);
+        assert_eq!(b["env"], env);
+        assert_eq!(b["limit"].as_u64(), Some(limit));
+        assert_eq!(b["cmd"], json!(["mixed"]));
+        // Docker's one-shot names no working dir and no tty.
+        assert_eq!(b["working_dir"], Value::Null);
+        assert_eq!(b["tty"], false);
+    }
+}
+
+#[tokio::test]
+async fn an_output_limit_refusal_passes_through_verbatim() {
+    let (ep, _) = fake_agent().await;
+    let e = target(&ep).exec_oneshot_limited("claude", cmd("big"), 5).await.unwrap_err();
+    assert_eq!(e, "OUTPUT_LIMIT: Command output exceeded 5 bytes and was abandoned");
+    assert!(e.starts_with(OUTPUT_LIMIT_MARKER));
+}
+
+#[tokio::test]
+async fn the_client_also_enforces_the_limit_on_what_it_buffers() {
+    // An agent that ignored `limit` still cannot make the client buffer past it.
+    let (ep, _) = fake_agent().await;
+    let e = target(&ep).exec_oneshot_limited("claude", cmd("mixed"), 8).await.unwrap_err();
+    assert!(e.starts_with(OUTPUT_LIMIT_MARKER), "{}", e);
+}
+
+#[tokio::test]
+async fn user_ids_come_from_the_same_probe_as_docker() {
+    let (ep, fake) = fake_agent().await;
+    assert_eq!(target(&ep).user_ids().await, (1000, 1001));
+    let b = fake.seen.lock().unwrap().exec_bodies[0].clone();
+    assert_eq!(b["cmd"], json!(["sh", "-c", "id -u; id -g"]));
+    assert_eq!(b["user"], "claude");
+    assert_eq!(b["limit"], 256);
+}
+
+// ── detached, status, resize ─────────────────────────────────────────────────
+
+#[tokio::test]
+async fn a_detached_exec_is_polled_until_it_reports_its_exit() {
+    let (ep, fake) = fake_agent().await;
+    let t = target(&ep);
+    let spec = ExecSpec::new(cmd("sleep")).user("root").working_dir(None).no_stdin();
+    let id = t.exec_detached(spec).await.unwrap();
+    assert_eq!(id, "d1");
+    assert_eq!(t.wait_exec_exit(&id).await, Some(7));
+    let s = fake.seen.lock().unwrap();
+    assert_eq!(s.status_polls, 3);
+    assert_eq!(s.detached_bodies[0]["user"], "root");
+    assert_eq!(s.detached_bodies[0]["working_dir"], Value::Null);
+    drop(s);
+    assert_eq!(t.wait_exec_exit("unknown").await, None);
+}
+
+#[tokio::test]
+async fn resize_posts_cols_and_rows() {
+    let (ep, fake) = fake_agent().await;
+    target(&ep).resize_exec("a1", 120, 40).await.unwrap();
+    let r = fake.seen.lock().unwrap().resizes.clone();
+    assert_eq!(r, vec![("a1".to_string(), json!({"cols": 120, "rows": 40}))]);
+}
+
+// ── attach ───────────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn attach_maps_channels_forwards_stdin_and_ends_on_exit() {
+    let (ep, fake) = fake_agent().await;
+    let t = target(&ep);
+    let spec = ExecSpec::new(cmd("cat")).env(vec!["A=1".into()]).tty(true);
+    let AttachedExec {
+        exec_id,
+        mut output,
+        mut input,
+    } = t.attach(spec).await.unwrap();
+    assert_eq!(exec_id, "a1");
+
+    assert_eq!(output.next().await.unwrap().unwrap(), ExecChunk::StdOut(Bytes::from_static(b"out")));
+    assert_eq!(output.next().await.unwrap().unwrap(), ExecChunk::StdErr(Bytes::from_static(b"err")));
+    assert_eq!(output.next().await.unwrap().unwrap(), ExecChunk::Other(Bytes::from_static(b"odd")));
+
+    input.write_all(b"hello ").await.unwrap();
+    input.write_all(b"agent").await.unwrap();
+    input.shutdown().await.unwrap();
+
+    assert_eq!(
+        output.next().await.unwrap().unwrap(),
+        ExecChunk::StdOut(Bytes::from_static(b"hello agent"))
+    );
+    // The exit frame ends the stream…
+    assert!(output.next().await.is_none());
+    // …and is what answers wait_exec_exit (the fake 404s `a1`).
+    assert_eq!(t.wait_exec_exit(&exec_id).await, Some(5));
+
+    let s = fake.seen.lock().unwrap();
+    assert!(s.close_stdin);
+    assert_eq!(s.stdin, b"hello agent");
+    let hello = s.attach_hello.clone().unwrap();
+    assert_eq!(hello["cmd"], json!(["cat"]));
+    assert_eq!(hello["user"], "claude");
+    assert_eq!(hello["working_dir"], "/workspace");
+    assert_eq!(hello["env"], json!(["A=1"]));
+    assert_eq!(hello["tty"], true);
+    assert_eq!(hello["attach_stdin"], true);
+}
+
+#[tokio::test]
+async fn an_attach_the_agent_refuses_is_an_error() {
+    let (ep, _) = fake_agent().await;
+    let Err(e) = target(&ep).attach(ExecSpec::new(cmd("nope"))).await else {
+        panic!("a refused attach succeeded")
+    };
+    assert_eq!(e, "Failed to start exec: no such user");
+}
+
+// ── files ────────────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn uploads_put_the_bytes_with_dir_name_mode_and_owner() {
+    let (ep, fake) = fake_agent().await;
+    let t = target(&ep);
+    assert_eq!(
+        t.upload_bytes_with_ids("/tmp/", "x.txt", b"hi", 0o755, (1000, 1001))
+            .await
+            .unwrap(),
+        "/tmp/x.txt"
+    );
+    assert_eq!(
+        t.upload_bytes("/home/claude/in", "p.tar", b"tar", 0o644).await.unwrap(),
+        "/home/claude/in/p.tar"
+    );
+    // The terminal drop's nested name: Docker's tar entry would land it in the
+    // subdirectory, so the agent is asked for that directory.
+    assert_eq!(
+        t.upload_bytes_with_ids("/tmp", "triple-c-drops/a.txt", b"a", 0o644, (1, 2))
+            .await
+            .unwrap(),
+        "/tmp/triple-c-drops/a.txt"
+    );
+    assert!(t.upload_bytes("/tmp", "../etc/x", b"", 0o644).await.is_err());
+
+    let up = fake.seen.lock().unwrap().uploads.clone();
+    let q = |i: usize, k: &str| up[i].0[k].clone();
+    assert_eq!((q(0, "dir"), q(0, "name"), q(0, "mode")), ("/tmp".into(), "x.txt".into(), "755".into()));
+    assert_eq!((q(0, "uid"), q(0, "gid")), ("1000".into(), "1001".into()));
+    assert_eq!(up[0].1, b"hi");
+    assert_eq!((q(1, "uid"), q(1, "gid"), q(1, "mode")), ("0".into(), "0".into(), "644".into()));
+    assert_eq!((q(2, "dir"), q(2, "name")), ("/tmp/triple-c-drops".into(), "a.txt".into()));
+    assert_eq!(up.len(), 3);
+}
+
+#[tokio::test]
+async fn a_host_file_upload_reads_through_the_shared_checked_reader() {
+    let (ep, fake) = fake_agent().await;
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("notes.txt");
+    std::fs::write(&path, b"from the host").unwrap();
+    let path = path.canonicalize().unwrap();
+    let t = target(&ep);
+    let got = t
+        .upload_host_file_with_ids(path.to_str().unwrap(), "/workspace/", "notes.txt", (7, 8))
+        .await
+        .unwrap();
+    assert_eq!(got, "/workspace/notes.txt");
+    // Without ids: resolved through the uid probe first.
+    t.upload_host_file(path.to_str().unwrap(), "/tmp", "n2.txt").await.unwrap();
+
+    let up = fake.seen.lock().unwrap().uploads.clone();
+    assert_eq!(up[0].1, b"from the host");
+    assert_eq!(up[0].0["mode"], "644");
+    assert_eq!((up[0].0["uid"].as_str(), up[0].0["gid"].as_str()), ("7", "8"));
+    assert_eq!((up[1].0["uid"].as_str(), up[1].0["gid"].as_str()), ("1000", "1001"));
+
+    let missing = dir.path().join("gone.txt");
+    let e = t
+        .upload_host_file_with_ids(missing.to_str().unwrap(), "/tmp", "g", (1, 1))
+        .await
+        .unwrap_err();
+    assert!(e.starts_with("Failed to read"), "{}", e);
+}
+
+#[tokio::test]
+async fn an_archive_is_streamed_and_a_missing_path_is_an_error() {
+    let (ep, _) = fake_agent().await;
+    let t = target(&ep);
+    let mut s = t.download_archive("/workspace/a dir");
+    let mut got = Vec::new();
+    while let Some(chunk) = s.next().await {
+        got.extend_from_slice(&chunk.unwrap());
+    }
+    assert_eq!(got, b"tar-part-1;tar-part-2;/workspace/a dir");
+
+    let mut s = t.download_archive("/missing");
+    let e = s.next().await.unwrap().unwrap_err();
+    assert_eq!(e, "Failed to download archive: no such path");
+    assert!(s.next().await.is_none());
+}
+
+// ── state ────────────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn is_running_follows_whether_the_agent_answers() {
+    let (ep, _) = fake_agent().await;
+    assert!(target(&ep).is_running().await.unwrap());
+    assert!(!target(&ep).has_exited().await);
+
+    let l = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    let port = l.local_addr().unwrap().port();
+    drop(l);
+    let gone = ContainerTarget::Agent(AgentEndpoint::loopback(port, TOKEN));
+    assert!(!gone.is_running().await.unwrap());
+    // Silence is not a positive exit.
+    assert!(!gone.has_exited().await);
+}
+
+// ── a hostile agent ──────────────────────────────────────────────────────────
+// The agent runs inside the container, which is not trusted with the host.
+
+/// Serve `app` on an ephemeral loopback port; return the port.
+async fn serve(app: Router) -> u16 {
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    tokio::spawn(async move {
+        axum::serve(listener, app).await.unwrap();
+    });
+    port
+}
+
+#[tokio::test]
+async fn a_redirect_from_the_agent_is_not_followed() {
+    let hits = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+    let elsewhere = {
+        let hits = hits.clone();
+        serve(Router::new().fallback(move || {
+            let hits = hits.clone();
+            async move {
+                hits.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+                "followed"
+            }
+        }))
+        .await
+    };
+    let to = format!("http://127.0.0.1:{}/anything", elsewhere);
+    let agent = serve(Router::new().fallback(move || {
+        let to = to.clone();
+        async move { (StatusCode::TEMPORARY_REDIRECT, [(axum::http::header::LOCATION, to)]) }
+    }))
+    .await;
+    let t = ContainerTarget::Agent(AgentEndpoint::loopback(agent, TOKEN));
+
+    assert!(t.exec_detached(ExecSpec::new(cmd("true"))).await.is_err());
+    assert!(t.exec_oneshot(cmd("true")).await.is_err());
+    assert!(t.is_running().await.is_err(), "a 3xx health answer is not 'running'");
+    assert_eq!(hits.load(std::sync::atomic::Ordering::SeqCst), 0, "the client followed a redirect");
+}
+
+#[tokio::test]
+async fn an_oversized_error_body_is_neither_buffered_nor_passed_through_whole() {
+    // 8 MiB of error text: past the small-body cap, so it is not even parsed.
+    let huge = serve(Router::new().fallback(|| async {
+        let body = json!({ "error": "x".repeat(8 * 1024 * 1024) });
+        (StatusCode::INTERNAL_SERVER_ERROR, Json(body))
+    }))
+    .await;
+    let e = ContainerTarget::Agent(AgentEndpoint::loopback(huge, TOKEN))
+        .exec_detached(ExecSpec::new(cmd("true")))
+        .await
+        .unwrap_err();
+    assert!(e.len() < 1024, "error was {} bytes", e.len());
+    assert!(e.contains("500"), "{e}");
+
+    // Under the body cap but long: parsed, then cut to the display cap.
+    let long = serve(Router::new().fallback(|| async {
+        let body = json!({ "error": "é".repeat(20 * 1024) });
+        (StatusCode::INTERNAL_SERVER_ERROR, Json(body))
+    }))
+    .await;
+    let e = ContainerTarget::Agent(AgentEndpoint::loopback(long, TOKEN))
+        .exec_detached(ExecSpec::new(cmd("true")))
+        .await
+        .unwrap_err();
+    assert!(e.len() <= 4 * 1024 + 64, "error was {} bytes", e.len());
+    assert!(e.ends_with('…'), "{e}");
+}
+
+#[tokio::test]
+async fn an_agent_that_accepts_and_then_says_nothing_cannot_hang_the_small_calls() {
+    // Accepts every connection, reads nothing, answers nothing, holds it open.
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    tokio::spawn(async move {
+        let mut held = Vec::new();
+        while let Ok((sock, _)) = listener.accept().await {
+            held.push(sock);
+        }
+    });
+    let t = ContainerTarget::Agent(AgentEndpoint::loopback(port, TOKEN));
+    let started = std::time::Instant::now();
+    assert!(t.exec_detached(ExecSpec::new(cmd("true"))).await.is_err());
+    assert!(t.resize_exec("abc", 80, 24).await.is_err());
+    assert_eq!(t.wait_exec_exit("abc").await, None);
+    // Three calls, each bounded by SMALL_REQUEST_TIMEOUT (1 s under test).
+    assert!(started.elapsed() < std::time::Duration::from_secs(10), "took {:?}", started.elapsed());
+}
+
+#[test]
+fn a_token_that_cannot_be_a_header_value_is_refused_up_front() {
+    let url = url::Url::parse("http://127.0.0.1:1/").unwrap();
+    for bad in ["", "has space", "new\nline", "tab\there", "ünïcode"] {
+        assert!(AgentEndpoint::new(url.clone(), bad).is_err(), "{bad:?} accepted");
+    }
+    assert!(AgentEndpoint::new(url, TOKEN).is_ok());
+}
+
+#[tokio::test]
+async fn a_413_that_is_not_the_limit_message_is_not_passed_through() {
+    let port = serve(Router::new().fallback(|| async {
+        (StatusCode::PAYLOAD_TOO_LARGE, Json(json!({ "error": "click here: http://evil.example" })))
+    }))
+    .await;
+    let e = ContainerTarget::Agent(AgentEndpoint::loopback(port, TOKEN))
+        .exec_oneshot_limited("claude", cmd("true"), 1000)
+        .await
+        .unwrap_err();
+    assert!(e.starts_with(OUTPUT_LIMIT_MARKER), "{e}");
+    assert!(!e.contains("evil"), "{e}");
+}

app/src-tauri/src/host/aws_host/tests.rs

@@ -0,0 +1,797 @@
+use std::collections::HashMap;
+use std::sync::atomic::AtomicUsize;
+use std::sync::Mutex;
+
+use aws_sdk_ecs::operation::register_task_definition::RegisterTaskDefinitionInput;
+use aws_sdk_ecs::operation::run_task::RunTaskInput;
+
+use super::*;
+use crate::aws::environments::Knowable;
+use crate::aws::tasks::TaskInfo;
+use crate::aws::workspace::{AccessPointRef, FileSystemRef, TaskDefinitionRef};
+use crate::aws::AwsError;
+use crate::host::lifecycle::ProjectHost;
+use crate::host::tunnels::tests::{fake_tunnel, FakeTunnel};
+use crate::models::{AwsPlacement, AwsWorkspaceConfig, StorageMode};
+
+const REGION: &str = "eu-west-1";
+const ACCOUNT: &str = "111122223333";
+const USER: &str = "AROAEXAMPLEID:alice@example.com";
+
+fn who() -> CallerIdentity {
+    CallerIdentity {
+        account: ACCOUNT.into(),
+        arn: format!("arn:aws:sts::{ACCOUNT}:assumed-role/dev/alice"),
+        user_id: USER.into(),
+    }
+}
+
+fn aws_project(storage: StorageMode) -> Project {
+    let mut p = Project::new("aws".into(), Vec::new());
+    p.host_id = Some("c1".into());
+    p.aws_placement = Some(AwsPlacement { region: REGION.into(), environment: "dev".into() });
+    p.aws = Some(AwsWorkspaceConfig { storage, ..Default::default() });
+    p
+}
+
+fn family(p: &Project) -> String {
+    task_family("dev", &owner_key(REGION, USER), &p.id)
+}
+
+fn task_arn(id: &str) -> String {
+    format!("arn:aws:ecs:{REGION}:{ACCOUNT}:task/triple-c-dev/{id}")
+}
+
+fn cluster_arn() -> String {
+    format!("arn:aws:ecs:{REGION}:{ACCOUNT}:cluster/triple-c-dev")
+}
+
+fn task(p: &Project, id: &str, last: &str, ready: bool) -> TaskInfo {
+    TaskInfo {
+        arn: task_arn(id),
+        last_status: last.into(),
+        desired_status: if last == "STOPPED" { "STOPPED" } else { "RUNNING" }.into(),
+        health: None,
+        stop_code: (last == "STOPPED").then(|| "EssentialContainerExited".into()),
+        stopped_reason: (last == "STOPPED").then(|| "Essential container exited".into()),
+        task_definition_arn: format!("arn:aws:ecs:{REGION}:{ACCOUNT}:task-definition/{}:1", family(p)),
+        runtime_id: ready.then(|| "rt-1".into()),
+        exec_agent_running: ready,
+        exit_code: None,
+        owner: Some(USER.into()),
+        project: Some(p.id.clone()),
+    }
+}
+
+fn record() -> String {
+    serde_json::json!({
+        "schema": 1, "name": "dev", "template_version": 1,
+        "cluster_arn": cluster_arn(),
+        "security_group_id": "sg-0123456789abcdef0",
+        "subnet_ids": ["subnet-0a", "subnet-0b"],
+        "assign_public_ip": true,
+        "kms_key_arn": format!("arn:aws:kms:{REGION}:{ACCOUNT}:key/1234-abcd"),
+        "log_group": "/triple-c/dev", "network_mode": "public", "tenancy": "strict"
+    })
+    .to_string()
+}
+
+/// One fake for all three AWS traits and the connector, logging calls.
+#[derive(Default)]
+struct Fake {
+    calls: Mutex<Vec<String>>,
+    /// ListTasks answers in turn; the last repeats.
+    listed: Mutex<Vec<Vec<String>>>,
+    tasks: Mutex<HashMap<String, TaskInfo>>,
+    /// What RunTask starts.
+    run: Option<TaskInfo>,
+    logs: Vec<String>,
+    role: Option<Knowable>,
+    connect_fails: bool,
+    connect_tokens: Mutex<Vec<String>>,
+    secret_json: Mutex<Option<String>>,
+    /// A losing start rotates the secret's token while this one connects.
+    rotated_by_loser: bool,
+    /// StopTask is refused (expired credentials, say).
+    stop_fails: bool,
+    /// What `on_task` was told, in order.
+    recorded: Mutex<Vec<Option<String>>>,
+    /// `group stream limit` of each log read.
+    log_reads: Mutex<Vec<String>>,
+}
+
+impl Fake {
+    fn log(&self, s: impl Into<String>) {
+        self.calls.lock().unwrap().push(s.into());
+    }
+    fn calls(&self) -> Vec<String> {
+        self.calls.lock().unwrap().clone()
+    }
+    fn called(&self, prefix: &str) -> bool {
+        self.calls().iter().any(|c| c.starts_with(prefix))
+    }
+    fn with_task(self, t: TaskInfo) -> Self {
+        self.tasks.lock().unwrap().insert(t.arn.clone(), t);
+        self
+    }
+}
+
+impl TaskApi for Fake {
+    async fn run_task(&self, _req: RunTaskInput) -> Result<TaskInfo, AwsError> {
+        self.log("run");
+        let t = self.run.clone().expect("a run was expected");
+        self.tasks.lock().unwrap().insert(t.arn.clone(), t.clone());
+        Ok(t)
+    }
+    async fn describe(&self, _c: &str, arns: &[String]) -> Result<Vec<TaskInfo>, AwsError> {
+        let t = self.tasks.lock().unwrap();
+        Ok(arns.iter().filter_map(|a| t.get(a).cloned()).collect())
+    }
+    async fn list_project_tasks(&self, _c: &str, _f: &str) -> Result<Vec<String>, AwsError> {
+        self.log("list");
+        let mut l = self.listed.lock().unwrap();
+        Ok(if l.len() > 1 { l.remove(0) } else { l.first().cloned().unwrap_or_default() })
+    }
+    async fn stop_task(&self, _c: &str, arn: &str, reason: &str) -> Result<(), AwsError> {
+        self.log(format!("stop {arn} {reason}"));
+        if self.stop_fails {
+            return Err(AwsError::Other { message: "ExpiredToken".into() });
+        }
+        Ok(())
+    }
+    async fn log_tail(&self, g: &str, st: &str, l: i32) -> Result<Vec<String>, AwsError> {
+        self.log_reads.lock().unwrap().push(format!("{g} {st} {l}"));
+        Ok(self.logs.clone())
+    }
+}
+
+impl WorkspaceApi for Fake {
+    async fn find_file_system(&self, _t: &str) -> Result<Option<FileSystemRef>, AwsError> {
+        Ok(Some(FileSystemRef { id: "fs-1".into(), owner: Some(USER.into()) }))
+    }
+    async fn access_points(&self, _fs: &str) -> Result<Vec<AccessPointRef>, AwsError> {
+        Ok(Vec::new())
+    }
+    async fn create_access_point(
+        &self,
+        _fs: &str,
+        _root: &str,
+        _tags: &[(String, String)],
+    ) -> Result<String, AwsError> {
+        self.log("create-ap");
+        Ok("fsap-new".into())
+    }
+    async fn put_project_secret(
+        &self,
+        _name: &str,
+        _kms: &str,
+        json: &str,
+        _tags: &[(String, String)],
+    ) -> Result<String, AwsError> {
+        self.log("put-secret");
+        *self.secret_json.lock().unwrap() = Some(json.into());
+        Ok(format!("arn:aws:secretsmanager:{REGION}:{ACCOUNT}:secret:triple-c/dev/x-AbCdEf"))
+    }
+    async fn task_definition_revisions(&self, _f: &str) -> Result<Vec<String>, AwsError> {
+        Ok(Vec::new())
+    }
+    async fn describe_task_definition(
+        &self,
+        _arn: &str,
+    ) -> Result<Option<TaskDefinitionRef>, AwsError> {
+        Ok(None)
+    }
+    async fn register_task_definition(
+        &self,
+        req: RegisterTaskDefinitionInput,
+    ) -> Result<String, AwsError> {
+        self.log("register");
+        Ok(format!(
+            "arn:aws:ecs:{REGION}:{ACCOUNT}:task-definition/{}:1",
+            req.family().unwrap()
+        ))
+    }
+}
+
+impl RuntimeApi for Fake {
+    async fn environment_record(&self, env: &str) -> Result<Option<String>, AwsError> {
+        self.log(format!("record {env}"));
+        Ok(Some(record()))
+    }
+    async fn role_exists(&self, _name: &str) -> Result<Knowable, AwsError> {
+        self.log("role");
+        Ok(self.role.clone().unwrap_or(Knowable::Yes))
+    }
+    async fn secret_string(&self, _name: &str) -> Result<String, AwsError> {
+        self.log("get-secret");
+        Ok(self
+            .secret_json
+            .lock()
+            .unwrap()
+            .clone()
+            .unwrap_or_else(|| r#"{"TRIPLEC_AGENT_TOKEN":"token-of-the-running-task"}"#.into()))
+    }
+    async fn access_point_state(&self, id: &str) -> Result<Option<String>, AwsError> {
+        self.log(format!("ap-state {id}"));
+        Ok(Some("available".into()))
+    }
+    async fn delete_secret(&self, _name: &str) -> Result<(), AwsError> {
+        Ok(())
+    }
+    async fn delete_access_point(&self, _id: &str) -> Result<(), AwsError> {
+        Ok(())
+    }
+}
+
+impl Connector for Fake {
+    async fn connect(
+        &self,
+        _task: &TaskInfo,
+        token: &str,
+    ) -> Result<(Box<dyn TunnelHandle>, AgentEndpoint), String> {
+        self.log("connect");
+        self.connect_tokens.lock().unwrap().push(token.into());
+        if self.rotated_by_loser {
+            let mut j = self.secret_json.lock().unwrap();
+            let mut v: serde_json::Value = serde_json::from_str(j.as_deref().unwrap()).unwrap();
+            v["TRIPLEC_AGENT_TOKEN"] = "the-losers-token".into();
+            *j = Some(v.to_string());
+        }
+        if self.connect_fails {
+            return Err("session-manager-plugin was not found".into());
+        }
+        Ok((
+            Box::new(FakeTunnel(std::sync::Arc::new(AtomicUsize::new(0)))),
+            AgentEndpoint::loopback(61100, token),
+        ))
+    }
+}
+
+fn inputs<'a>(
+    p: &'a Project,
+    who: &'a CallerIdentity,
+    on_task: &'a (dyn Fn(Option<&TaskRecord>) + Send + Sync),
+) -> StartInputs<'a> {
+    StartInputs {
+        on_task,
+        project: p,
+        who,
+        env_pairs: &[],
+        files: &[],
+        image: REGISTRY_IMAGE,
+        wait: WaitTiming {
+            interval: Duration::from_millis(1),
+            timeout: Duration::from_millis(30),
+        },
+        access_point_wait: PollTiming {
+            interval: Duration::from_millis(1),
+            timeout: Duration::from_millis(30),
+        },
+    }
+}
+
+async fn start(fake: &Fake, p: &Project) -> (Result<Started, String>, Vec<String>) {
+    let w = who();
+    let steps = Mutex::new(Vec::new());
+    let progress = |m: &str| steps.lock().unwrap().push(m.to_string());
+    let on_task = |r: Option<&TaskRecord>| {
+        fake.recorded.lock().unwrap().push(r.map(|r| r.task_arn.clone()));
+    };
+    let r = start_core(fake, fake, fake, fake, &inputs(p, &w, &on_task), &progress).await;
+    (r, steps.into_inner().unwrap())
+}
+
+#[tokio::test]
+async fn a_first_start_prepares_runs_waits_and_connects_in_that_order() {
+    let p = aws_project(StorageMode::Hybrid);
+    let fake = Fake { run: Some(task(&p, "new", "RUNNING", true)), ..Default::default() };
+    let (r, steps) = start(&fake, &p).await;
+    let started = r.unwrap();
+    assert!(started.created);
+    assert_eq!(started.access_point_id.as_deref(), Some("fsap-new"));
+    assert_eq!(started.task.arn, task_arn("new"));
+    assert_eq!(
+        fake.calls(),
+        vec![
+            "record dev", "role", "list", "create-ap", "put-secret", "register",
+            "ap-state fsap-new", "list", "run", "connect", "get-secret"
+        ],
+        "look for a live task before rotating the token; the access point is available before RunTask"
+    );
+    assert_eq!(steps, vec![PROGRESS_READING, PROGRESS_PREPARING, PROGRESS_STARTING, PROGRESS_WAITING, PROGRESS_CONNECTING]);
+    assert_eq!(*fake.recorded.lock().unwrap(), vec![Some(task_arn("new"))], "recorded before the wait");
+    // The connector got the token the secret was just written with.
+    let secret: serde_json::Value =
+        serde_json::from_str(fake.secret_json.lock().unwrap().as_deref().unwrap()).unwrap();
+    assert_eq!(
+        fake.connect_tokens.lock().unwrap()[0],
+        secret["TRIPLEC_AGENT_TOKEN"].as_str().unwrap()
+    );
+}
+
+#[tokio::test]
+async fn a_running_task_is_attached_with_its_own_token_and_nothing_is_rewritten() {
+    let p = aws_project(StorageMode::Hybrid);
+    let live = task(&p, "live", "RUNNING", true);
+    let fake = Fake {
+        listed: Mutex::new(vec![vec![live.arn.clone()]]),
+        ..Default::default()
+    }
+    .with_task(live);
+    let (r, steps) = start(&fake, &p).await;
+    let started = r.unwrap();
+    assert!(!started.created);
+    assert_eq!(started.access_point_id, None);
+    assert_eq!(fake.calls(), vec!["record dev", "role", "list", "get-secret", "connect"]);
+    assert_eq!(fake.connect_tokens.lock().unwrap()[0], "token-of-the-running-task");
+    assert_eq!(steps, vec![PROGRESS_READING, PROGRESS_WAITING, PROGRESS_CONNECTING]);
+}
+
+#[tokio::test]
+async fn losing_the_run_race_is_a_clear_error_and_nothing_is_stopped() {
+    let p = aws_project(StorageMode::Ephemeral);
+    let other = task(&p, "other", "RUNNING", true);
+    let fake = Fake {
+        // Nothing at the first look; a concurrent start's task at the second.
+        listed: Mutex::new(vec![vec![], vec![other.arn.clone()]]),
+        ..Default::default()
+    }
+    .with_task(other);
+    let (r, _) = start(&fake, &p).await;
+    assert_eq!(r.err().as_deref(), Some(START_RACE));
+    assert_eq!(*fake.recorded.lock().unwrap(), vec![Some(task_arn("other"))], "the live task is recorded");
+    assert!(!fake.called("run") && !fake.called("stop") && !fake.called("connect"));
+}
+
+#[tokio::test]
+async fn a_task_that_stops_while_starting_is_reported_with_its_log() {
+    let p = aws_project(StorageMode::Ephemeral);
+    let fake = Fake {
+        run: Some(task(&p, "dies", "STOPPED", false)),
+        logs: vec!["entrypoint: cannot decode TRIPLEC_FILES".into()],
+        ..Default::default()
+    };
+    let (r, _) = start(&fake, &p).await;
+    let e = r.err().unwrap();
+    assert!(e.contains("Essential container exited") && e.contains("cannot decode"), "{e}");
+    assert!(!fake.called("connect"));
+}
+
+#[tokio::test]
+async fn a_task_that_never_gets_ready_is_stopped_and_its_log_shown() {
+    let p = aws_project(StorageMode::Ephemeral);
+    let fake = Fake {
+        run: Some(task(&p, "slow", "PENDING", false)),
+        logs: vec!["pulling image".into()],
+        ..Default::default()
+    };
+    let (r, _) = start(&fake, &p).await;
+    let e = r.err().unwrap();
+    assert!(e.contains("did not become ready") && e.contains("pulling image"), "{e}");
+    assert!(fake.calls().contains(&format!("stop {} {STOP_REASON}", task_arn("slow"))));
+    assert_eq!(
+        *fake.recorded.lock().unwrap(),
+        vec![Some(task_arn("slow")), None],
+        "the ARN is stored before the wait, and forgotten once the task is stopped"
+    );
+}
+
+#[tokio::test]
+async fn a_tunnel_failure_stops_a_task_this_start_ran_but_never_an_attached_one() {
+    let p = aws_project(StorageMode::Ephemeral);
+    let fake = Fake {
+        run: Some(task(&p, "new", "RUNNING", true)),
+        connect_fails: true,
+        ..Default::default()
+    };
+    let (r, _) = start(&fake, &p).await;
+    assert!(r.err().unwrap().contains("session-manager-plugin"));
+    assert!(fake.calls().contains(&format!("stop {} {STOP_REASON}", task_arn("new"))));
+
+    let live = task(&p, "live", "RUNNING", true);
+    let attached = Fake {
+        listed: Mutex::new(vec![vec![live.arn.clone()]]),
+        connect_fails: true,
+        ..Default::default()
+    }
+    .with_task(live);
+    let (r, _) = start(&attached, &p).await;
+    assert!(r.is_err());
+    assert!(!attached.called("stop"));
+    assert_eq!(
+        *attached.recorded.lock().unwrap(),
+        vec![Some(task_arn("live"))],
+        "an attached task stays recorded: it is still running"
+    );
+}
+
+#[tokio::test]
+async fn a_user_who_has_not_joined_is_told_before_anything_is_written() {
+    let p = aws_project(StorageMode::Hybrid);
+    let fake = Fake { role: Some(Knowable::No), ..Default::default() };
+    let (r, _) = start(&fake, &p).await;
+    assert!(r.err().unwrap().contains("not joined"));
+    assert_eq!(fake.calls(), vec!["record dev", "role"]);
+}
+
+// ──────────────────────────────────────────────────────────────── inputs
+
+#[test]
+fn aws_runs_registry_images_only() {
+    let mut s = AppSettings { image_source: ImageSource::LocalBuild, ..Default::default() };
+    assert_eq!(aws_image(&s).unwrap(), REGISTRY_IMAGE);
+    s.image_source = ImageSource::Registry;
+    assert_eq!(aws_image(&s).unwrap(), REGISTRY_IMAGE);
+    s.image_source = ImageSource::Custom;
+    for good in ["registry.example.com/team/img:1", "ghcr.io/x/y", "user/repo:tag", "reg:5000/a"] {
+        s.custom_image_name = Some(good.into());
+        assert_eq!(aws_image(&s).unwrap(), good);
+    }
+    for bad in ["", "triple-c:latest", "ubuntu", "localhost/x", "127.0.0.1:5000/x", "a /b", "/x"] {
+        s.custom_image_name = Some(bad.into());
+        assert!(aws_image(&s).is_err(), "{bad}");
+    }
+}
+
+#[test]
+fn the_sandbox_is_forced_off_on_aws() {
+    let mut p = aws_project(StorageMode::Ephemeral);
+    p.sandbox_mode_enabled = true;
+    let (pairs, _) = aws_env(&p, &AppSettings::default()).unwrap();
+    let settings = &pairs.iter().find(|(k, _)| k == "CLAUDE_CODE_SETTINGS_JSON").unwrap().1;
+    let v: serde_json::Value = serde_json::from_str(settings).unwrap();
+    assert_eq!(v["sandbox"]["enabled"], false, "{settings}");
+}
+
+#[test]
+fn files_for_the_secret_come_from_the_ssh_folder_without_leaving_it() {
+    let base = tempfile::tempdir().unwrap();
+    let ssh = base.path().join("ssh");
+    std::fs::create_dir(&ssh).unwrap();
+    std::fs::write(ssh.join("id_ed25519"), b"KEY").unwrap();
+    std::fs::write(ssh.join("config"), b"Host *").unwrap();
+    std::fs::create_dir(ssh.join("sub")).unwrap();
+    std::fs::write(ssh.join("sub/nested"), b"x").unwrap();
+    std::fs::write(base.path().join("outside"), b"SECRET-OUTSIDE").unwrap();
+    #[cfg(unix)]
+    {
+        std::os::unix::fs::symlink(base.path().join("outside"), ssh.join("escape")).unwrap();
+        std::os::unix::fs::symlink(ssh.join("config"), ssh.join("alias")).unwrap();
+    }
+    let got = workspace_files(Some(ssh.to_str().unwrap()), None).unwrap();
+    let names: Vec<&str> = got.iter().map(|(k, _)| k.as_str()).collect();
+    #[cfg(unix)]
+    assert_eq!(names, vec!["ssh/alias", "ssh/config", "ssh/id_ed25519"]);
+    #[cfg(not(unix))]
+    assert_eq!(names, vec!["ssh/config", "ssh/id_ed25519"]);
+    assert!(got.iter().all(|(_, v)| v != b"SECRET-OUTSIDE"));
+
+    std::fs::write(ssh.join("huge"), vec![b'x'; MAX_FILE_BYTES as usize + 1]).unwrap();
+    let e = workspace_files(Some(ssh.to_str().unwrap()), None).unwrap_err();
+    assert!(e.contains("huge") && e.contains("64 KiB"), "{e}");
+
+    assert!(workspace_files(Some("/"), None).is_err(), "a filesystem root is refused");
+    assert!(workspace_files(None, None).unwrap().is_empty());
+}
+
+#[test]
+fn ca_files_are_what_docker_would_mount() {
+    let base = tempfile::tempdir().unwrap();
+    let dir = base.path().join("ca");
+    std::fs::create_dir(&dir).unwrap();
+    std::fs::write(dir.join("corp.pem"), b"PEM").unwrap();
+    std::fs::write(dir.join("README"), b"not a cert").unwrap();
+    let ca = crate::docker::ca_certs::resolve(Some(dir.to_str().unwrap())).unwrap().unwrap();
+    let got = workspace_files(None, Some(&ca)).unwrap();
+    assert_eq!(got, vec![("ca/corp.pem".to_string(), b"PEM".to_vec())]);
+
+    let one = base.path().join("Root CA.pem");
+    std::fs::write(&one, b"ONE").unwrap();
+    let ca = crate::docker::ca_certs::resolve(Some(one.to_str().unwrap())).unwrap().unwrap();
+    let got = workspace_files(None, Some(&ca)).unwrap();
+    assert_eq!(got, vec![("ca/Root_CA.crt".to_string(), b"ONE".to_vec())]);
+}
+
+// ───────────────────────────────────────────────── targets and reconcile
+
+#[tokio::test]
+async fn an_aws_projects_target_is_its_registered_tunnel() {
+    let mut p = aws_project(StorageMode::Ephemeral);
+    p.container_id = Some("http://127.0.0.1:61200/".into());
+    assert_eq!(ProjectHost::for_project(&p), ProjectHost::Aws);
+    assert_eq!(ContainerTarget::for_project(&p), None, "no tunnel, no target, whatever is stored");
+    tunnels::register(&p.id, fake_tunnel(61200, std::sync::Arc::new(AtomicUsize::new(0))));
+    assert_eq!(
+        ContainerTarget::for_project(&p),
+        Some(ContainerTarget::Agent(AgentEndpoint::loopback(61200, "tok")))
+    );
+    assert_eq!(
+        ContainerTarget::for_project_waiting(&p).await,
+        ContainerTarget::for_project(&p)
+    );
+    tunnels::close(&p.id).await;
+
+    let local = Project::new("local".into(), Vec::new());
+    assert_eq!(ProjectHost::for_project(&local), ProjectHost::Docker);
+}
+
+fn find(p: &Project) -> FindTask {
+    FindTask::new(p, REGION, USER)
+}
+
+fn store_with(p: &Project) -> (tempfile::TempDir, ProjectsStore) {
+    let dir = tempfile::tempdir().unwrap();
+    let store = ProjectsStore::over_file_for_test(dir.path().join("projects.json"), vec![p.clone()]);
+    (dir, store)
+}
+
+#[tokio::test]
+async fn reconcile_marks_a_project_whose_task_stopped_as_stopped() {
+    let mut p = aws_project(StorageMode::Hybrid);
+    p.status = ProjectStatus::Running;
+    {
+        let a = p.aws.as_mut().unwrap();
+        a.task_arn = Some(task_arn("gone"));
+        a.access_point_id = Some("fsap-1".into());
+        a.task_definition_arn = Some("arn:td:1".into());
+    }
+    let fake = Fake::default().with_task(task(&p, "gone", "STOPPED", false));
+    let (_d, store) = store_with(&p);
+    assert_eq!(reconcile_project(&fake, &store, &p, &find(&p)).await.unwrap(), Reconciled::Gone);
+    let after = store.get(&p.id).unwrap();
+    assert_eq!(after.status, ProjectStatus::Stopped);
+    let a = after.aws.unwrap();
+    assert_eq!(a.task_arn, None, "a stopped task's ARN is cleared");
+    assert_eq!(a.access_point_id.as_deref(), Some("fsap-1"), "the data's access point stays");
+
+    // ECS has forgotten it: also gone.
+    let forgotten = Fake::default();
+    let (_d, store) = store_with(&p);
+    assert_eq!(reconcile_project(&forgotten, &store, &p, &find(&p)).await.unwrap(), Reconciled::Gone);
+    assert_eq!(store.get(&p.id).unwrap().status, ProjectStatus::Stopped);
+}
+
+#[tokio::test]
+async fn reconcile_keeps_a_project_with_a_live_task_running() {
+    let mut p = aws_project(StorageMode::Hybrid);
+    p.status = ProjectStatus::Running;
+    p.aws.as_mut().unwrap().task_arn = Some(task_arn("up"));
+    let fake = Fake::default().with_task(task(&p, "up", "RUNNING", true));
+    let (_d, store) = store_with(&p);
+    assert!(matches!(reconcile_project(&fake, &store, &p, &find(&p)).await.unwrap(), Reconciled::Live(_)));
+    assert_eq!(store.get(&p.id).unwrap().status, ProjectStatus::Running);
+}
+
+#[tokio::test]
+async fn the_watch_reports_a_running_aws_project_as_its_stored_target_and_confirms_a_recorded_stop() {
+    let mut p = aws_project(StorageMode::Ephemeral);
+    p.status = ProjectStatus::Running;
+    p.container_id = Some("http://127.0.0.1:61300/".into());
+    p.aws.as_mut().unwrap().task_arn = Some(task_arn("w1"));
+    let w = watched_task(&p).expect("watched");
+    assert_eq!(w.target.id(), "http://127.0.0.1:61300/", "settle's running_on matches the stored id");
+    assert_eq!(w.group.cluster_arn, cluster_arn());
+    assert_eq!(w.group.connection_id, "c1");
+    assert!(!w.target.has_exited().await, "nothing recorded yet");
+    record_stopped(std::slice::from_ref(&p), &[(task_arn("w1"), StopKind::Idle)]);
+    assert!(w.target.has_exited().await);
+    assert_eq!(crate::host::tunnels::stop_kind(w.target.id()), Some(StopKind::Idle));
+
+    let mut stopped = p.clone();
+    stopped.status = ProjectStatus::Stopped;
+    assert!(watched_task(&stopped).is_none(), "a Stopped project is not polled again");
+    let local = Project::new("l".into(), Vec::new());
+    assert!(watched_task(&local).is_none());
+}
+
+#[tokio::test]
+async fn the_winner_of_a_start_race_puts_its_token_back_in_the_secret() {
+    let p = aws_project(StorageMode::Ephemeral);
+    let fake = Fake {
+        run: Some(task(&p, "new", "RUNNING", true)),
+        rotated_by_loser: true,
+        ..Default::default()
+    };
+    let (r, _) = start(&fake, &p).await;
+    r.unwrap();
+    let ours = fake.connect_tokens.lock().unwrap()[0].clone();
+    let calls = fake.calls();
+    assert_eq!(&calls[calls.len() - 3..], ["connect", "get-secret", "put-secret"]);
+    let v: serde_json::Value =
+        serde_json::from_str(fake.secret_json.lock().unwrap().as_deref().unwrap()).unwrap();
+    assert_eq!(v["TRIPLEC_AGENT_TOKEN"], ours.as_str());
+    assert!(v.get("TRIPLEC_FILES").is_some(), "the rest of the payload is kept");
+}
+
+#[tokio::test]
+async fn an_unchanged_secret_is_not_rewritten_after_a_start() {
+    let p = aws_project(StorageMode::Ephemeral);
+    let fake = Fake { run: Some(task(&p, "new", "RUNNING", true)), ..Default::default() };
+    start(&fake, &p).await.0.unwrap();
+    assert_eq!(fake.calls().iter().filter(|c| *c == "put-secret").count(), 1);
+}
+
+#[test]
+fn a_refused_token_says_to_restart_the_workspace() {
+    assert_eq!(
+        refusal_message("Agent health check failed: the agent rejected the credentials (401)"),
+        TOKEN_MISMATCH
+    );
+    assert!(refusal_message("Agent health check failed: agent returned HTTP 500").contains("500"));
+}
+
+#[tokio::test]
+async fn reconcile_finds_a_task_whose_arn_was_never_stored() {
+    // The app quit during "Waiting for the task" in a build that stored the
+    // ARN only at the end: the task is found by family and tags.
+    let mut p = aws_project(StorageMode::Ephemeral);
+    p.status = ProjectStatus::Running;
+    let live = task(&p, "orphan", "RUNNING", true);
+    let fake = Fake { listed: Mutex::new(vec![vec![live.arn.clone()]]), ..Default::default() }
+        .with_task(live);
+    let (_d, store) = store_with(&p);
+    assert!(matches!(
+        reconcile_project(&fake, &store, &p, &find(&p)).await.unwrap(),
+        Reconciled::Live(_)
+    ));
+    let after = store.get(&p.id).unwrap();
+    assert_eq!(after.status, ProjectStatus::Running);
+    assert_eq!(after.aws.unwrap().task_arn, Some(task_arn("orphan")), "now stored");
+
+    let nothing = Fake::default();
+    let (_d, store) = store_with(&p);
+    assert_eq!(reconcile_project(&nothing, &store, &p, &find(&p)).await.unwrap(), Reconciled::Gone);
+    assert_eq!(store.get(&p.id).unwrap().status, ProjectStatus::Stopped);
+}
+
+#[test]
+fn a_reattach_registers_only_while_the_project_still_runs_that_task() {
+    let mut p = aws_project(StorageMode::Ephemeral);
+    p.status = ProjectStatus::Running;
+    p.aws.as_mut().unwrap().task_arn = Some(task_arn("t"));
+    let (_d, store) = store_with(&p);
+    assert!(reattach_still_wanted(&store, &p.id, &task_arn("t")));
+    assert!(!reattach_still_wanted(&store, &p.id, &task_arn("other")));
+    store.update_status(&p.id, ProjectStatus::Stopping).unwrap();
+    assert!(!reattach_still_wanted(&store, &p.id, &task_arn("t")));
+    store.remove(&p.id).unwrap();
+    assert!(!reattach_still_wanted(&store, &p.id, &task_arn("t")));
+}
+
+#[test]
+fn a_start_records_its_task_and_keeps_the_stored_handles_it_does_not_know() {
+    let mut p = aws_project(StorageMode::Hybrid);
+    p.aws.as_mut().unwrap().access_point_id = Some("fsap-old".into());
+    let (_d, store) = store_with(&p);
+    record_task(
+        &store,
+        &p.id,
+        Some(&TaskRecord { task_arn: "arn:t".into(), access_point_id: None, task_definition_arn: Some("arn:td:2".into()) }),
+    );
+    let a = store.get(&p.id).unwrap().aws.unwrap();
+    assert_eq!((a.task_arn.as_deref(), a.access_point_id.as_deref(), a.task_definition_arn.as_deref()),
+        (Some("arn:t"), Some("fsap-old"), Some("arn:td:2")));
+    record_task(&store, &p.id, None);
+    let a = store.get(&p.id).unwrap().aws.unwrap();
+    assert_eq!((a.task_arn, a.access_point_id.as_deref()), (None, Some("fsap-old")));
+}
+
+#[tokio::test]
+async fn a_task_that_could_not_be_stopped_after_a_failed_start_stays_recorded() {
+    let p = aws_project(StorageMode::Ephemeral);
+    let fake = Fake {
+        run: Some(task(&p, "slow", "PENDING", false)),
+        stop_fails: true,
+        ..Default::default()
+    };
+    assert!(start(&fake, &p).await.0.is_err());
+    assert!(fake.called("stop"));
+    assert_eq!(*fake.recorded.lock().unwrap(), vec![Some(task_arn("slow"))], "still findable");
+
+    let fake = Fake {
+        run: Some(task(&p, "new", "RUNNING", true)),
+        connect_fails: true,
+        stop_fails: true,
+        ..Default::default()
+    };
+    assert!(start(&fake, &p).await.0.is_err());
+    assert_eq!(*fake.recorded.lock().unwrap(), vec![Some(task_arn("new"))]);
+}
+
+#[tokio::test]
+async fn the_task_log_reads_the_tasks_stream_in_the_records_log_group() {
+    let p = aws_project(StorageMode::Hybrid);
+    let fake = Fake { logs: vec!["line 1".into(), "line 2".into()], ..Default::default() };
+    let lines = task_log_lines(&fake, &fake, &p, &who(), REGION, &task_arn("abc"), 20).await.unwrap();
+    assert_eq!(lines, vec!["line 1", "line 2"]);
+    let prefix = log_stream_prefix(&owner_key(REGION, USER), &p.id);
+    assert_eq!(
+        *fake.log_reads.lock().unwrap(),
+        vec![format!("/triple-c/dev {prefix}/workspace/abc 20")]
+    );
+}
+
+#[test]
+fn the_log_task_is_the_stored_one_else_the_last_one_a_start_saw() {
+    let mut p = aws_project(StorageMode::Hybrid);
+    p.id = "log-task-test-project".into();
+    assert_eq!(log_task_arn(&p), None);
+    let (_d, store) = store_with(&p);
+    record_task(
+        &store,
+        &p.id,
+        Some(&TaskRecord { task_arn: "arn:first".into(), access_point_id: None, task_definition_arn: None }),
+    );
+    record_task(&store, &p.id, None);
+    assert_eq!(log_task_arn(&p).as_deref(), Some("arn:first"), "a cleared ARN still has a log");
+    p.aws.as_mut().unwrap().task_arn = Some("arn:current".into());
+    assert_eq!(log_task_arn(&p).as_deref(), Some("arn:current"));
+}
+
+#[tokio::test]
+async fn reconcile_falls_back_to_a_newer_live_task_when_the_stored_one_stopped() {
+    // m3: another machine restarted the project; the stored ARN is history.
+    let mut p = aws_project(StorageMode::Ephemeral);
+    p.status = ProjectStatus::Running;
+    p.aws.as_mut().unwrap().task_arn = Some(task_arn("old"));
+    let newer = task(&p, "newer", "RUNNING", true);
+    let fake = Fake { listed: Mutex::new(vec![vec![newer.arn.clone()]]), ..Default::default() }
+        .with_task(task(&p, "old", "STOPPED", false))
+        .with_task(newer);
+    let (_d, store) = store_with(&p);
+    assert!(matches!(
+        reconcile_project(&fake, &store, &p, &find(&p)).await.unwrap(),
+        Reconciled::Live(t) if t.arn == task_arn("newer")
+    ));
+    let after = store.get(&p.id).unwrap();
+    assert_eq!(after.status, ProjectStatus::Running);
+    assert_eq!(after.aws.unwrap().task_arn, Some(task_arn("newer")));
+
+    // ECS forgot the stored one and nothing else runs: Gone, after looking.
+    let fake = Fake::default();
+    let (_d, store) = store_with(&p);
+    assert_eq!(reconcile_project(&fake, &store, &p, &find(&p)).await.unwrap(), Reconciled::Gone);
+    assert!(fake.called("list"), "it looked for another task first");
+}
+
+#[tokio::test]
+async fn reconcile_forgets_a_stale_stop_on_the_unattached_id_before_reusing_it() {
+    use crate::host::tunnels;
+    let mut p = aws_project(StorageMode::Ephemeral);
+    p.status = ProjectStatus::Running;
+    p.aws.as_mut().unwrap().task_arn = Some(task_arn("u2"));
+    let placeholder = tunnels::unattached_id(&p.id);
+    // A past unattached spell's task was seen stopped under this id.
+    tunnels::mark_stopped(&placeholder, StopKind::Spot);
+    p.container_id = Some("http://127.0.0.1:61400/".into());
+    assert_eq!(prepare_unattached(&p), Some(placeholder.clone()));
+    assert!(!tunnels::is_stopped(&placeholder), "the live task must not read as stopped");
+    // Already on the placeholder: nothing to store, the mark still goes.
+    p.container_id = Some(placeholder.clone());
+    tunnels::mark_stopped(&placeholder, StopKind::Spot);
+    assert_eq!(prepare_unattached(&p), None);
+    assert!(!tunnels::is_stopped(&placeholder));
+    assert_eq!(prepare_unattached(&Project::new("l".into(), Vec::new())), None);
+}
+
+#[tokio::test]
+async fn an_unattached_aws_project_gets_a_target_id_no_tunnel_can_have() {
+    // m9: the last run's loopback port may belong to another project's
+    // tunnel now.
+    let mut p = aws_project(StorageMode::Ephemeral);
+    p.status = ProjectStatus::Running;
+    p.container_id = Some("http://127.0.0.1:61400/".into());
+    p.aws.as_mut().unwrap().task_arn = Some(task_arn("u1"));
+    let id = unattached_container_id(&p).expect("replaced");
+    assert_eq!(id, format!("http://unattached.invalid/{}/", p.id));
+    p.container_id = Some(id.clone());
+    assert_eq!(unattached_container_id(&p), None, "idempotent");
+    // The watch still reports it, by that id, and a registered tunnel on the
+    // old port can't be confused with it.
+    let w = watched_task(&p).expect("still watched");
+    assert_eq!(w.target.id(), id);
+    p.container_id = None;
+    assert_eq!(unattached_container_id(&p), None, "nothing stored, nothing to replace");
+    let local = Project::new("l".into(), Vec::new());
+    assert_eq!(unattached_container_id(&local), None);
+}

app/src-tauri/src/host/lifecycle.rs

@@ -0,0 +1,391 @@
+//! Bringing a project's container into existence, starting, stopping and
+//! removing it — the host-specific half of the project lifecycle commands.
+//!
+//! The commands in `commands/project_commands.rs` keep everything that is the
+//! same on every host: validating the LLM backend config, the Bedrock SSO
+//! check, project status transitions, the project lock, closing terminal
+//! sessions, the auth bridge, marketplace and credential syncs. They ask a
+//! [`ProjectHost`] for the rest. For Docker that is the
+//! find → maybe-snapshot-and-recreate → create → start sequence, which used to
+//! sit inline in `start_project_container_locked` and is moved here unchanged.
+//!
+//! Docker-only operations with no host-neutral meaning — base-image migration,
+//! snapshot sweeps, legacy cleanup at startup — keep calling `crate::docker`
+//! directly; see the boundary test in `host/mod.rs`.
+
+use super::ContainerTarget;
+use crate::docker;
+use crate::models::{AppSettings, Project};
+use crate::models::container_config;
+use crate::storage::projects_store::ProjectsStore;
+
+/// The host a project runs on: the local Docker daemon, or an ECS Fargate
+/// task in an AWS environment (`aws_host.rs`; the connection, region and
+/// environment come from the project).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ProjectHost {
+    Docker,
+    Aws,
+}
+
+/// An agent target is a way *into* a container, not a handle on its
+/// lifecycle: whatever runs the container (ECS, the local harness) stops and
+/// removes it. Reaching here means a caller paired the Docker host with an
+/// agent target, which is a bug to surface, not a panic.
+const AGENT_LIFECYCLE: &str =
+    "{op} a container is not supported for an agent target; the host that runs it owns its lifecycle";
+
+/// What a host could not clean up when asked to discard a project's state.
+/// Docker: the snapshot image and the named volumes.
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+pub struct DiscardLeftovers {
+    pub image: Option<String>,
+    pub volumes: Vec<String>,
+}
+
+impl ProjectHost {
+    pub fn for_project(project: &Project) -> Self {
+        if project.is_aws() {
+            ProjectHost::Aws
+        } else {
+            ProjectHost::Docker
+        }
+    }
+
+    /// Make sure the project's container exists, matches the project's
+    /// current configuration, and is running. Returns where it runs.
+    ///
+    /// `progress` receives the same human-readable steps the start view has
+    /// always shown. Failure leaves the caller to reset the project status.
+    /// `store`: the AWS host records a task's ARN in it as soon as the task
+    /// exists, so a crash during the long wait leaves it findable.
+    pub async fn ensure_started(
+        &self,
+        project: &Project,
+        settings: &AppSettings,
+        store: &ProjectsStore,
+        progress: &(dyn Fn(&str) + Send + Sync),
+    ) -> Result<ContainerTarget, String> {
+        match self {
+            ProjectHost::Docker => docker_ensure_started(project, settings, progress)
+                .await
+                .map(ContainerTarget::docker),
+            ProjectHost::Aws => super::aws_host::ensure_started(project, settings, store, progress).await,
+        }
+    }
+
+    /// The container the host currently has for this project, found by asking
+    /// the host rather than trusting `project.container_id` — that field can
+    /// be stale (a crash between remove and the store update, a hand-edited
+    /// `projects.json`).
+    pub async fn find_current(&self, project: &Project) -> Result<Option<ContainerTarget>, String> {
+        match self {
+            ProjectHost::Docker => Ok(docker::find_existing_container(project)
+                .await?
+                .map(ContainerTarget::docker)),
+            // The tunnel registry: an AWS project's target exists while its
+            // tunnel is open.
+            ProjectHost::Aws => Ok(ContainerTarget::for_project(project)),
+        }
+    }
+
+    /// Stop the container behind `target`. For an agent target that is the
+    /// ECS task behind a registered tunnel (`StopTask`, reason "Stopped from
+    /// Triple-C"), and the tunnel is closed.
+    pub async fn stop(&self, target: &ContainerTarget) -> Result<(), String> {
+        match target {
+            ContainerTarget::Docker { container_id } => docker::stop_container(container_id).await,
+            ContainerTarget::Agent(ep) => super::aws_host::stop_endpoint(ep)
+                .await
+                .unwrap_or_else(|| Err(AGENT_LIFECYCLE.replace("{op}", "Stopping"))),
+        }
+    }
+
+    /// Stop a project's container whether or not the app holds a target for
+    /// it. Docker: the stored container. AWS: the tunnel's task, else the
+    /// stored task ARN, else the project's live task — a project whose
+    /// tunnel could not be re-opened must still be stoppable.
+    pub async fn stop_project(&self, project: &Project, settings: &AppSettings) -> Result<(), String> {
+        match self {
+            ProjectHost::Docker => match ContainerTarget::for_project(project) {
+                Some(t) => self.stop(&t).await,
+                None => Ok(()),
+            },
+            ProjectHost::Aws => super::aws_host::stop_project(project, settings).await,
+        }
+    }
+
+    /// Stop (errors ignored — a stopped container is the goal) and remove.
+    /// An agent target is stopped; its resources go with
+    /// [`Self::remove_aws_resources`].
+    pub async fn remove(&self, target: &ContainerTarget) -> Result<(), String> {
+        match target {
+            ContainerTarget::Docker { container_id } => {
+                let _ = docker::stop_container(container_id).await;
+                docker::remove_container(container_id).await
+            }
+            ContainerTarget::Agent(ep) => super::aws_host::stop_endpoint(ep)
+                .await
+                .unwrap_or_else(|| Err(AGENT_LIFECYCLE.replace("{op}", "Removing"))),
+        }
+    }
+
+    /// AWS: stop the task and remove the project's resources — task
+    /// definition revisions, the secret (deleted at once) and, only
+    /// with `discard_data`, the EFS access point (not its files). Docker: nothing (its state
+    /// goes with [`Self::discard_project_state`]).
+    pub async fn remove_aws_resources(
+        &self,
+        project: &Project,
+        settings: &AppSettings,
+        discard_data: bool,
+    ) -> Result<(), String> {
+        match self {
+            ProjectHost::Docker => Ok(()),
+            ProjectHost::Aws => super::aws_host::remove_resources(project, settings, discard_data).await,
+        }
+    }
+
+    /// Delete what outlives the container — for Docker the snapshot image and
+    /// both named volumes (`~/.claude`, the OAuth login and transcripts go with
+    /// them). Best-effort; reports what it could not remove.
+    pub async fn discard_project_state(&self, project: &Project) -> DiscardLeftovers {
+        match self {
+            ProjectHost::Docker => {
+                let mut left = DiscardLeftovers::default();
+                if let Err(e) = docker::remove_snapshot_image(project).await {
+                    log::warn!("Failed to remove snapshot image for project {}: {}", project.id, e);
+                    left.image = Some(docker::get_snapshot_image_name(project));
+                }
+                left.volumes = docker::remove_project_volumes(project).await;
+                left
+            }
+            // Removed by `remove_aws_resources`, which needs the settings.
+            ProjectHost::Aws => DiscardLeftovers::default(),
+        }
+    }
+
+    /// Remove leftovers of features this host no longer has (Docker: the
+    /// deleted MCP feature's containers and network).
+    pub async fn remove_legacy_leftovers(&self, project: &Project) {
+        match self {
+            ProjectHost::Docker => {
+                docker::remove_legacy_mcp_containers(&project.id).await;
+                docker::remove_legacy_project_network(&project.id).await;
+            }
+            ProjectHost::Aws => {}
+        }
+    }
+}
+
+/// The Docker start sequence, moved here verbatim from
+/// `start_project_container_locked`. Returns the running container's id.
+async fn docker_ensure_started(
+    project: &Project,
+    settings: &AppSettings,
+    progress: &(dyn Fn(&str) + Send + Sync),
+) -> Result<String, String> {
+    let image_name =
+        container_config::resolve_image_name(&settings.image_source, &settings.custom_image_name);
+
+    // Ensure image exists
+    progress("Checking image...");
+    if !docker::image_exists(&image_name).await? {
+        return Err(format!("Docker image '{}' not found. Please pull or build the image first.", image_name));
+    }
+
+    // Determine docker socket path
+    let docker_socket = settings.docker_socket_path
+        .as_deref()
+        .map(|s| s.to_string())
+        .unwrap_or_else(|| docker::default_docker_socket());
+
+    // AWS config path from global settings
+    let aws_config_path = settings.global_aws.aws_config_path.clone();
+
+    // What we would create this container from *right now*: the project's
+    // snapshot when one exists, else the configured base. This is the value
+    // `container_needs_recreation` compares against the container's
+    // `triple-c.create-image` label — the check that replaced the old
+    // tautological one. It is resolved *before* the commit below, so it
+    // describes the pre-commit world the existing container was born into.
+    let snapshot_image = docker::get_snapshot_image_name(project);
+    let expected_create_image =
+        if docker::image_exists(&snapshot_image).await.unwrap_or(false) {
+            snapshot_image.clone()
+        } else {
+            image_name.clone()
+        };
+
+    let container_id = if let Some(existing_id) = docker::find_existing_container(project).await? {
+        // Check if config changed — if so, snapshot + recreate
+        let needs_recreate = docker::container_needs_recreation(
+            &existing_id,
+            project,
+            &expected_create_image,
+            &settings.global_aws,
+            &settings.global_ollama,
+            &settings.global_llamacpp,
+            &settings.global_openai_compatible,
+            settings.global_claude_instructions.as_deref(),
+            &settings.global_custom_env_vars,
+            settings.timezone.as_deref(),
+            settings.global_claude_code_settings.as_ref(),
+            settings.default_ssh_key_path.as_deref(),
+            settings.ca_cert_path.as_deref(),
+            settings.default_git_user_name.as_deref(),
+            settings.default_git_user_email.as_deref(),
+        ).await.unwrap_or(false);
+
+        if needs_recreate {
+            log::info!("Container config changed for project {} — committing snapshot and recreating", project.id);
+            // Snapshot the filesystem before destroying
+            progress("Saving container state...");
+            if let Err(e) = docker::commit_container_snapshot(&existing_id, project).await {
+                log::warn!("Failed to snapshot container before recreation: {}", e);
+            }
+            progress("Recreating container...");
+            let _ = docker::stop_container(&existing_id).await;
+            docker::remove_container(&existing_id).await?;
+
+            // Legacy MCP cleanup: the old container may have been attached to
+            // `triple-c-net-<projectId>`. Tear down leftover MCP containers and
+            // that network now, before the replacement is created without it.
+            docker::remove_legacy_mcp_containers(&project.id).await;
+            docker::remove_legacy_project_network(&project.id).await;
+
+            // Create from snapshot image (preserves system-level changes).
+            // Re-resolved after the commit above: when no snapshot existed
+            // before, one does now, and creating from the base instead
+            // would throw away the state that was just saved.
+            let create_image = if docker::image_exists(&snapshot_image).await.unwrap_or(false) {
+                snapshot_image.clone()
+            } else {
+                image_name.clone()
+            };
+
+            let new_id = docker::create_container_for_project(
+                project,
+                settings,
+                &docker_socket,
+                aws_config_path.as_deref(),
+                &create_image,
+                &image_name,
+                docker::CreateExtras::default(),
+            ).await?;
+            progress("Starting container...");
+            docker::start_container(&new_id).await?;
+
+            // The commit above moved `:latest` and orphaned the image it
+            // used to point at; the container holding that image open was
+            // removed a few lines up, so now is when Docker will actually
+            // let it go. Detached because this is housekeeping and the
+            // project is already running — and it sweeps every orphan, not
+            // just this one, so recreations that happened before the sweep
+            // existed are cleaned up too.
+            tauri::async_runtime::spawn(async {
+                docker::sweep_orphaned_snapshots_logged("after recreation").await;
+            });
+
+            new_id
+        } else {
+            progress("Starting container...");
+            docker::start_container(&existing_id).await?;
+            existing_id
+        }
+    } else {
+        // Container doesn't exist (first start, or Docker pruned it).
+        // Check for a snapshot image first — it preserves system-level
+        // changes (apt/pip/npm installs) from the previous session.
+        if expected_create_image == snapshot_image {
+            log::info!("Creating container from snapshot image for project {}", project.id);
+        }
+        let create_image = expected_create_image.clone();
+
+        progress("Creating container...");
+        let new_id = docker::create_container_for_project(
+            project,
+            settings,
+            &docker_socket,
+            aws_config_path.as_deref(),
+            &create_image,
+            &image_name,
+            docker::CreateExtras::default(),
+        ).await?;
+        progress("Starting container...");
+        docker::start_container(&new_id).await?;
+        new_id
+    };
+
+    Ok(container_id)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// End to end against a real daemon and the registry sandbox image: a
+    /// throwaway project (fresh UUID, so its container, volumes and snapshot
+    /// name are its own) is started, reached, stopped, started again on the
+    /// *same* container, then removed and its state discarded.
+    #[tokio::test]
+    #[ignore = "needs a Docker daemon and the triple-c-sandbox image; creates and removes a throwaway project container"]
+    async fn a_project_container_round_trips_through_the_host() {
+        let project = Project::new("lifecycle-live-test".to_string(), Vec::new());
+        let settings = AppSettings::default();
+        let store_dir = tempfile::tempdir().expect("temp dir");
+        let store = ProjectsStore::over_file_for_test(store_dir.path().join("projects.json"), Vec::new());
+        let host = ProjectHost::for_project(&project);
+        let steps = std::sync::Mutex::new(Vec::<String>::new());
+        let progress = |m: &str| steps.lock().unwrap().push(m.to_string());
+        // Failures inside the round trip return instead of panicking, so the
+        // cleanup below always runs.
+        fn check(ok: bool, what: &str) -> Result<(), String> {
+            if ok { Ok(()) } else { Err(format!("check failed: {what}")) }
+        }
+
+        let outcome = async {
+            check(host.find_current(&project).await?.is_none(), "no container before the first start")?;
+
+            let first = host.ensure_started(&project, &settings, &store, &progress).await?;
+            check(first.is_running().await?, "running after start")?;
+            let (out, code) = first
+                .exec_oneshot_env_status(vec!["id".into(), "-un".into()], vec![])
+                .await?;
+            check(out.trim() == "claude" && code == 0, "exec runs as claude")?;
+            check(host.find_current(&project).await? == Some(first.clone()), "find_current names it")?;
+
+            host.stop(&first).await?;
+            check(first.has_exited().await, "exited after stop")?;
+
+            // Same config, so the existing container is started, not recreated.
+            let second = host.ensure_started(&project, &settings, &store, &progress).await?;
+            check(second == first, "restart reuses the container")?;
+            check(second.is_running().await?, "running after restart")?;
+
+            host.remove(&second).await?;
+            check(host.find_current(&project).await?.is_none(), "gone after remove")?;
+            Ok::<_, String>(())
+        }
+        .await;
+
+        // Always clean up, even after a failed assertion above.
+        if let Ok(Some(t)) = host.find_current(&project).await {
+            let _ = host.remove(&t).await;
+        }
+        let left = host.discard_project_state(&project).await;
+        outcome.expect("round trip");
+        assert_eq!(left, DiscardLeftovers::default(), "nothing left behind");
+        let steps = steps.into_inner().unwrap();
+        assert_eq!(
+            steps,
+            [
+                "Checking image...",
+                "Creating container...",
+                "Starting container...",
+                "Checking image...",
+                "Starting container...",
+            ]
+        );
+    }
+}

app/src-tauri/src/host/mod.rs

@@ -0,0 +1,620 @@
+//! Where a project's container runs, and the one interface the rest of the app
+//! uses to reach inside it.
+//!
+//! Spec: `docs/superpowers/specs/2026-11-13-aws-ecs-host-design.md` ("Host
+//! abstraction"). This is phase 1 of that plan: every operation that happens
+//! *inside* a project container — one-shot and attached execs, file transfer,
+//! "is it running" — goes through [`ContainerTarget`] instead of naming
+//! `docker::exec` or bollard directly. Today the only variant is
+//! [`ContainerTarget::Docker`], which delegates to the existing code in
+//! `docker/exec.rs` and `docker/container.rs` with no change in behaviour.
+//! [`ContainerTarget::Agent`] reaches a container through the in-container
+//! `triple-c-agent` instead (`agent.rs`), which is how the AWS host will get in.
+//!
+//! ## Why an enum and not a trait object
+//!
+//! The set of hosts is closed and known at compile time, every method is async,
+//! and a `dyn` async trait would need boxing on every call (or the
+//! `async-trait` crate) for no benefit. Adding a host means adding a variant and
+//! letting the compiler point at every `match` that needs an arm.
+//!
+//! ## What does *not* go through here
+//!
+//! Things that only make sense for the local Docker host: image build/pull,
+//! base-image migration, snapshot commits, volumes, the LiteLLM gateway and STT
+//! sidecars, and (until phase 1b) container create/start/stop and the `die`
+//! event stream. Those keep calling `crate::docker` directly. The
+//! `no_container_interior_bollard_outside_the_host_layer` test pins which files
+//! may still do so.
+
+pub mod agent;
+pub mod aws_host;
+pub mod lifecycle;
+pub mod sessions;
+pub mod ssm;
+pub mod tunnels;
+pub mod watch;
+
+pub use crate::docker::exec::{
+    MAX_DROP_BYTES, OUTPUT_LIMIT_MARKER, PROC_NET_OUTPUT_LIMIT,
+};
+pub use agent::AgentEndpoint;
+pub use sessions::ExecSessionManager;
+
+use bytes::Bytes;
+use futures_util::Stream;
+use std::pin::Pin;
+use tokio::io::AsyncWrite;
+
+use crate::docker;
+use crate::models::Project;
+
+/// One chunk of output from an exec, already demultiplexed.
+///
+/// Host-neutral stand-in for bollard's `LogOutput`. With `tty = true` there is
+/// no stdout/stderr split and everything arrives as [`ExecChunk::StdOut`] (Docker
+/// reports a TTY stream as `Console`, which maps here too — consumers that cared
+/// treated the two the same).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ExecChunk {
+    StdOut(Bytes),
+    StdErr(Bytes),
+    /// stdin echo or anything else a host might surface. Consumers ignore it.
+    Other(Bytes),
+}
+
+impl ExecChunk {
+    pub fn into_bytes(self) -> Bytes {
+        match self {
+            ExecChunk::StdOut(b) | ExecChunk::StdErr(b) | ExecChunk::Other(b) => b,
+        }
+    }
+}
+
+pub type ExecOutputStream = Pin<Box<dyn Stream<Item = Result<ExecChunk, String>> + Send>>;
+
+/// An exec that has been created and started with its streams attached.
+///
+/// `input` is a sink that is never read when the exec was opened with
+/// `attach_stdin: false`.
+pub struct AttachedExec {
+    pub exec_id: String,
+    pub output: ExecOutputStream,
+    pub input: Pin<Box<dyn AsyncWrite + Send>>,
+}
+
+/// Everything about an attached exec except where it runs.
+///
+/// Defaults match what this app has always used: run as `claude` in
+/// `/workspace`, no TTY, stdin attached, no extra env.
+#[derive(Debug, Clone)]
+pub struct ExecSpec {
+    pub cmd: Vec<String>,
+    pub user: String,
+    pub working_dir: Option<String>,
+    pub env: Vec<String>,
+    pub tty: bool,
+    pub attach_stdin: bool,
+}
+
+impl ExecSpec {
+    pub fn new(cmd: Vec<String>) -> Self {
+        Self {
+            cmd,
+            user: "claude".to_string(),
+            working_dir: Some("/workspace".to_string()),
+            env: Vec::new(),
+            tty: false,
+            attach_stdin: true,
+        }
+    }
+    pub fn user(mut self, user: &str) -> Self {
+        self.user = user.to_string();
+        self
+    }
+    pub fn working_dir(mut self, dir: Option<&str>) -> Self {
+        self.working_dir = dir.map(str::to_string);
+        self
+    }
+    pub fn env(mut self, env: Vec<String>) -> Self {
+        self.env = env;
+        self
+    }
+    pub fn tty(mut self, tty: bool) -> Self {
+        self.tty = tty;
+        self
+    }
+    pub fn no_stdin(mut self) -> Self {
+        self.attach_stdin = false;
+        self
+    }
+}
+
+/// A byte stream of a tar archive read out of a container.
+pub type ArchiveStream = Pin<Box<dyn Stream<Item = Result<Bytes, String>> + Send>>;
+
+/// A specific project container on a specific host.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub enum ContainerTarget {
+    /// A container on the local Docker daemon, by id or name.
+    Docker { container_id: String },
+    /// A container reached through the in-container `triple-c-agent`
+    /// (`host/agent.rs`; protocol in
+    /// `docs/superpowers/specs/2026-11-13-triple-c-agent-protocol.md`). Used
+    /// by the AWS host (later) and the local agent harness. The host that
+    /// runs the container, not this target, owns its lifecycle.
+    Agent(AgentEndpoint),
+}
+
+impl ContainerTarget {
+    pub fn docker(container_id: impl Into<String>) -> Self {
+        ContainerTarget::Docker {
+            container_id: container_id.into(),
+        }
+    }
+
+    /// The target for a project's container, if it has one yet. An AWS
+    /// project's is its registered tunnel's agent endpoint (`tunnels.rs`):
+    /// none while no tunnel is open.
+    pub fn for_project(project: &Project) -> Option<Self> {
+        if project.is_aws() {
+            return tunnels::get_endpoint(&project.id).map(ContainerTarget::Agent);
+        }
+        project.container_id.as_deref().map(Self::docker)
+    }
+
+    /// [`Self::for_project`], waiting (up to `aws_host::REATTACH_WAIT`) for an
+    /// AWS project whose tunnel is being re-opened in the background after a
+    /// restart. For a Docker project it is `for_project`.
+    pub async fn for_project_waiting(project: &Project) -> Option<Self> {
+        if project.is_aws() {
+            return tunnels::wait_endpoint(&project.id, aws_host::REATTACH_WAIT)
+                .await
+                .map(ContainerTarget::Agent);
+        }
+        Self::for_project(project)
+    }
+
+    /// The host-specific identifier (a Docker container id today). For logs
+    /// and for keying per-container state; never parse it.
+    pub fn id(&self) -> &str {
+        match self {
+            ContainerTarget::Docker { container_id } => container_id,
+            ContainerTarget::Agent(ep) => ep.base_url.as_str(),
+        }
+    }
+
+    // ── state ────────────────────────────────────────────────────────────────
+
+    /// Whether the container is running. An inspect failure (gone, daemon
+    /// down) reads as `false`, as `docker::is_container_running` always has.
+    pub async fn is_running(&self) -> Result<bool, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::container::is_container_running(container_id).await
+            }
+            ContainerTarget::Agent(ep) => agent::is_running(ep).await,
+        }
+    }
+
+    // ── one-shot execs ───────────────────────────────────────────────────────
+
+    /// Run as `claude`, return combined output. Errors on a non-UTF-8-safe
+    /// transport failure only; a non-zero exit is *not* an error here.
+    pub async fn exec_oneshot(&self, cmd: Vec<String>) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot(container_id, cmd).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_oneshot_as(ep, "claude", cmd, Vec::new())
+                .await
+                .map(|(out, _)| out),
+        }
+    }
+
+    pub async fn exec_oneshot_env(
+        &self,
+        cmd: Vec<String>,
+        env: Vec<String>,
+    ) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot_env(container_id, cmd, env).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_oneshot_as(ep, "claude", cmd, env)
+                .await
+                .map(|(out, _)| out),
+        }
+    }
+
+    pub async fn exec_oneshot_env_status(
+        &self,
+        cmd: Vec<String>,
+        env: Vec<String>,
+    ) -> Result<(String, i64), String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot_env_status(container_id, cmd, env).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_oneshot_as(ep, "claude", cmd, env).await,
+        }
+    }
+
+    pub async fn exec_oneshot_as(
+        &self,
+        user: &str,
+        cmd: Vec<String>,
+        env: Vec<String>,
+    ) -> Result<(String, i64), String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot_as(container_id, user, cmd, env).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_oneshot_as(ep, user, cmd, env).await,
+        }
+    }
+
+    pub async fn exec_oneshot_limited(
+        &self,
+        user: &str,
+        cmd: Vec<String>,
+        limit: usize,
+    ) -> Result<(String, i64), String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot_limited(container_id, user, cmd, limit).await
+            }
+            ContainerTarget::Agent(ep) => {
+                agent::exec_oneshot_limited(ep, user, cmd, Vec::new(), limit).await
+            }
+        }
+    }
+
+    /// [`Self::exec_oneshot_limited`] for a background poll: on the agent it
+    /// carries the background marker, so it never counts as activity for
+    /// idle stop. Docker has no idle stop; the call is the same there.
+    pub async fn exec_oneshot_background(
+        &self,
+        user: &str,
+        cmd: Vec<String>,
+        limit: usize,
+    ) -> Result<(String, i64), String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot_limited(container_id, user, cmd, limit).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_oneshot_background(ep, user, cmd, limit).await,
+        }
+    }
+
+    /// stdout and stderr kept apart: `(stdout, stderr, exit_code)`.
+    pub async fn exec_oneshot_streams_as(
+        &self,
+        user: &str,
+        cmd: Vec<String>,
+        env: Vec<String>,
+    ) -> Result<(String, String, i64), String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot_streams_as(container_id, user, cmd, env).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_oneshot_streams_as(ep, user, cmd, env).await,
+        }
+    }
+
+    /// [`Self::exec_oneshot_streams_as`] for a background poll (the file
+    /// viewer's change check): on the agent it carries the background marker,
+    /// so it never counts as activity for idle stop. The same call on Docker.
+    pub async fn exec_oneshot_streams_background(
+        &self,
+        user: &str,
+        cmd: Vec<String>,
+    ) -> Result<(String, String, i64), String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot_streams_as(container_id, user, cmd, Vec::new()).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_oneshot_streams_background(ep, user, cmd).await,
+        }
+    }
+
+    /// Start a command and return without waiting or reading its output.
+    /// Returns the exec id.
+    pub async fn exec_detached(&self, spec: ExecSpec) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_detached(container_id, &spec).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_detached(ep, &spec).await,
+        }
+    }
+
+    // ── attached execs ───────────────────────────────────────────────────────
+
+    /// Run as `claude` in `/workspace` with stdin attached.
+    pub async fn attach_exec(&self, cmd: Vec<String>, tty: bool) -> Result<AttachedExec, String> {
+        self.attach(ExecSpec::new(cmd).tty(tty)).await
+    }
+
+    pub async fn attach(&self, spec: ExecSpec) -> Result<AttachedExec, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::create_attached_exec_spec(container_id, &spec).await
+            }
+            ContainerTarget::Agent(ep) => agent::attach(ep, &spec).await,
+        }
+    }
+
+    /// The exit code of an exec this target started, once it has finished.
+    /// `None` if the host could not say.
+    pub async fn wait_exec_exit(&self, exec_id: &str) -> Option<i64> {
+        match self {
+            ContainerTarget::Docker { .. } => docker::exec::wait_for_exec_exit(exec_id).await,
+            ContainerTarget::Agent(ep) => agent::wait_exec_exit(ep, exec_id).await,
+        }
+    }
+
+    pub async fn resize_exec(&self, exec_id: &str, cols: u16, rows: u16) -> Result<(), String> {
+        match self {
+            ContainerTarget::Docker { .. } => docker::exec::resize_exec(exec_id, cols, rows).await,
+            ContainerTarget::Agent(ep) => agent::resize_exec(ep, exec_id, cols, rows).await,
+        }
+    }
+
+    // ── files ────────────────────────────────────────────────────────────────
+
+    /// The container user's `(uid, gid)`, falling back to `(1000, 1000)`.
+    pub async fn user_ids(&self) -> (u64, u64) {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::container_user_ids(container_id).await
+            }
+            ContainerTarget::Agent(ep) => agent::user_ids(ep).await,
+        }
+    }
+
+    /// Write `data` to `dest_dir/file_name` as root-owned with `mode`.
+    pub async fn upload_bytes(
+        &self,
+        dest_dir: &str,
+        file_name: &str,
+        data: &[u8],
+        mode: u32,
+    ) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::upload_bytes_to_container(
+                    container_id,
+                    dest_dir,
+                    file_name,
+                    data,
+                    mode,
+                )
+                .await
+            }
+            ContainerTarget::Agent(ep) => {
+                agent::upload_bytes_with_ids(ep, dest_dir, file_name, data, mode, (0, 0)).await
+            }
+        }
+    }
+
+    /// [`Self::upload_bytes`] with the owner set to `ids`.
+    pub async fn upload_bytes_with_ids(
+        &self,
+        dest_dir: &str,
+        file_name: &str,
+        data: &[u8],
+        mode: u32,
+        ids: (u64, u64),
+    ) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::upload_bytes_with_ids(
+                    container_id,
+                    dest_dir,
+                    file_name,
+                    data,
+                    mode,
+                    ids,
+                )
+                .await
+            }
+            ContainerTarget::Agent(ep) => {
+                agent::upload_bytes_with_ids(ep, dest_dir, file_name, data, mode, ids).await
+            }
+        }
+    }
+
+    /// Copy a host file in, owned by the container user.
+    pub async fn upload_host_file(
+        &self,
+        host_path: &str,
+        dest_dir: &str,
+        dest_name: &str,
+    ) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::upload_host_file_to_container(
+                    container_id,
+                    host_path,
+                    dest_dir,
+                    dest_name,
+                )
+                .await
+            }
+            ContainerTarget::Agent(ep) => {
+                let ids = agent::user_ids(ep).await;
+                agent::upload_host_file_with_ids(ep, host_path, dest_dir, dest_name, ids).await
+            }
+        }
+    }
+
+    /// [`Self::upload_host_file`] with the owner ids already known.
+    pub async fn upload_host_file_with_ids(
+        &self,
+        host_path: &str,
+        dest_dir: &str,
+        dest_name: &str,
+        ids: (u64, u64),
+    ) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::upload_host_file_with_ids(
+                    container_id,
+                    host_path,
+                    dest_dir,
+                    dest_name,
+                    ids,
+                )
+                .await
+            }
+            ContainerTarget::Agent(ep) => {
+                agent::upload_host_file_with_ids(ep, host_path, dest_dir, dest_name, ids).await
+            }
+        }
+    }
+
+    /// Read `path` out of the container as a tar stream (Docker's archive
+    /// API). Dropping the stream cancels the transfer.
+    pub fn download_archive(&self, path: &str) -> ArchiveStream {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::download_archive(container_id, path)
+            }
+            ContainerTarget::Agent(ep) => agent::download_archive(ep, path),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn exec_spec_defaults_match_what_the_app_always_used() {
+        let s = ExecSpec::new(vec!["true".into()]);
+        assert_eq!(s.user, "claude");
+        assert_eq!(s.working_dir.as_deref(), Some("/workspace"));
+        assert!(s.env.is_empty());
+        assert!(!s.tty);
+        assert!(s.attach_stdin);
+    }
+
+    #[test]
+    fn for_project_follows_the_container_id() {
+        let mut p: Project = serde_json::from_value(serde_json::json!({
+            "id": "p1", "name": "p", "paths": [], "container_id": null,
+            "status": "stopped", "backend": "anthropic",
+            "allow_docker_access": false, "full_permissions": false,
+            "created_at": "now", "updated_at": "now"
+        }))
+        .expect("minimal project deserializes");
+        assert_eq!(ContainerTarget::for_project(&p), None);
+        p.container_id = Some("abc".into());
+        assert_eq!(
+            ContainerTarget::for_project(&p),
+            Some(ContainerTarget::docker("abc"))
+        );
+        assert_eq!(ContainerTarget::docker("abc").id(), "abc");
+    }
+
+    /// Every non-`docker/`, non-`host/` source file, with its path relative to
+    /// `src/`, minus the files in `allowed`.
+    fn sources_outside_the_host_layer(allowed: &[&str]) -> Vec<(String, String)> {
+        let src = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+        let mut out = Vec::new();
+        let mut stack = vec![src.clone()];
+        while let Some(dir) = stack.pop() {
+            for entry in std::fs::read_dir(&dir).unwrap() {
+                let path = entry.unwrap().path();
+                let rel = path
+                    .strip_prefix(&src)
+                    .unwrap()
+                    .to_string_lossy()
+                    .replace('\\', "/");
+                if path.is_dir() {
+                    if rel != "docker" && rel != "host" {
+                        stack.push(path);
+                    }
+                    continue;
+                }
+                if rel.ends_with(".rs") && !allowed.contains(&rel.as_str()) {
+                    out.push((rel, std::fs::read_to_string(&path).unwrap()));
+                }
+            }
+        }
+        out.sort();
+        out
+    }
+
+    /// Docker-only by nature: base-image migration replays apt, restores a
+    /// payload, commits and swaps containers. It has no AWS meaning.
+    const DOCKER_ONLY: &[&str] = &["commands/migration_commands.rs"];
+
+    /// The host boundary, pinned: outside `docker/` and `host/`, nothing names
+    /// bollard or `docker::exec`. Container-interior code goes through
+    /// [`ContainerTarget`]. Shrink [`DOCKER_ONLY`]; do not grow it.
+    #[test]
+    fn no_container_interior_bollard_outside_the_host_layer() {
+        let offenders: Vec<String> = sources_outside_the_host_layer(DOCKER_ONLY)
+            .into_iter()
+            .filter(|(_, text)| {
+                text.contains("bollard::")
+                    || text.contains("docker::exec")
+                    || text.contains("get_docker")
+            })
+            .map(|(rel, _)| rel)
+            .collect();
+        assert!(
+            offenders.is_empty(),
+            "these files reach into the container without going through host::ContainerTarget: {:?}",
+            offenders
+        );
+    }
+
+    /// The lifecycle half of the boundary: outside `docker/` and `host/`, no
+    /// non-test code creates, starts, stops, finds or recreates a container
+    /// itself (that is [`lifecycle::ProjectHost`]'s job), and none builds a
+    /// [`ContainerTarget::docker`] from a bare id, which would hard-code the
+    /// host. Comments and `#[cfg(test)]` code are not checked.
+    ///
+    /// `docker::remove_container` is deliberately absent: startup's
+    /// pending-cleanup retry removes Docker leftovers it recorded *by name*,
+    /// which is Docker housekeeping, not lifecycle.
+    #[test]
+    fn no_container_lifecycle_or_bare_docker_targets_outside_the_host_layer() {
+        const BANNED: &[&str] = &[
+            "docker::create_container(",
+            "docker::start_container(",
+            "docker::stop_container(",
+            "docker::find_existing_container(",
+            "docker::container_needs_recreation(",
+            "docker::commit_container_snapshot(",
+            "docker::remove_snapshot_image(",
+            "docker::remove_project_volumes(",
+            "docker::is_container_running(",
+            "container::is_container_running(",
+            "ContainerTarget::docker(",
+        ];
+        let mut offenders = Vec::new();
+        for (rel, text) in sources_outside_the_host_layer(DOCKER_ONLY) {
+            let code = text.split("#[cfg(test)]").next().unwrap_or("");
+            for (n, line) in code.lines().enumerate() {
+                let line = line.trim_start();
+                if line.starts_with("//") {
+                    continue;
+                }
+                for pat in BANNED {
+                    if line.contains(pat) {
+                        offenders.push(format!("{}:{}: {}", rel, n + 1, pat));
+                    }
+                }
+            }
+        }
+        assert!(
+            offenders.is_empty(),
+            "container lifecycle / bare Docker targets outside host::lifecycle:\n{}",
+            offenders.join("\n")
+        );
+    }
+}

app/src-tauri/src/host/sessions.rs

@@ -0,0 +1,214 @@
+//! Interactive exec sessions — terminals and the audio bridge — keyed by the
+//! frontend's session id. Host-neutral: every session holds the
+//! [`ContainerTarget`] it was opened on and does all its I/O through it.
+//! (Moved here from `docker/exec.rs` in phase 1 of the AWS host work.)
+
+use futures_util::StreamExt;
+use std::collections::HashMap;
+use std::sync::Arc;
+use tokio::io::AsyncWriteExt;
+use tokio::sync::{mpsc, Mutex};
+
+use super::{AttachedExec, ContainerTarget};
+
+pub struct ExecSession {
+    pub exec_id: String,
+    pub target: ContainerTarget,
+    pub input_tx: mpsc::UnboundedSender<Vec<u8>>,
+    shutdown_tx: mpsc::Sender<()>,
+}
+
+impl ExecSession {
+    pub async fn send_input(&self, data: Vec<u8>) -> Result<(), String> {
+        self.input_tx
+            .send(data)
+            .map_err(|e| format!("Failed to send input: {}", e))
+    }
+
+    #[allow(dead_code)]
+    pub async fn resize(&self, cols: u16, rows: u16) -> Result<(), String> {
+        self.target.resize_exec(&self.exec_id, cols, rows).await
+    }
+
+    pub fn shutdown(&self) {
+        let _ = self.shutdown_tx.try_send(());
+    }
+}
+
+pub struct ExecSessionManager {
+    sessions: Arc<Mutex<HashMap<String, ExecSession>>>,
+}
+
+impl ExecSessionManager {
+    pub fn new() -> Self {
+        Self {
+            sessions: Arc::new(Mutex::new(HashMap::new())),
+        }
+    }
+
+    pub async fn create_session<F>(
+        &self,
+        target: &ContainerTarget,
+        session_id: &str,
+        cmd: Vec<String>,
+        on_output: F,
+        on_exit: Box<dyn FnOnce() + Send>,
+    ) -> Result<(), String>
+    where
+        F: Fn(Vec<u8>) + Send + 'static,
+    {
+        self.create_session_with_tty(target, session_id, cmd, true, on_output, on_exit)
+            .await
+    }
+
+    pub async fn create_session_with_tty<F>(
+        &self,
+        target: &ContainerTarget,
+        session_id: &str,
+        cmd: Vec<String>,
+        tty: bool,
+        on_output: F,
+        on_exit: Box<dyn FnOnce() + Send>,
+    ) -> Result<(), String>
+    where
+        F: Fn(Vec<u8>) + Send + 'static,
+    {
+        let AttachedExec {
+            exec_id,
+            mut output,
+            mut input,
+        } = target.attach_exec(cmd, tty).await?;
+
+        let (input_tx, mut input_rx) = mpsc::unbounded_channel::<Vec<u8>>();
+        let (shutdown_tx, mut shutdown_rx) = mpsc::channel::<()>(1);
+
+        // Output reader task
+        let session_id_clone = session_id.to_string();
+        let shutdown_tx_clone = shutdown_tx.clone();
+        tokio::spawn(async move {
+            loop {
+                tokio::select! {
+                    msg = output.next() => {
+                        match msg {
+                            Some(Ok(output)) => {
+                                on_output(output.into_bytes().to_vec());
+                            }
+                            Some(Err(e)) => {
+                                log::error!("Exec output error for {}: {}", session_id_clone, e);
+                                break;
+                            }
+                            None => {
+                                log::info!("Exec output stream ended for {}", session_id_clone);
+                                break;
+                            }
+                        }
+                    }
+                    _ = shutdown_rx.recv() => {
+                        log::info!("Exec session {} shutting down", session_id_clone);
+                        break;
+                    }
+                }
+            }
+            on_exit();
+            let _ = shutdown_tx_clone;
+        });
+
+        // Input writer task
+        tokio::spawn(async move {
+            while let Some(data) = input_rx.recv().await {
+                if let Err(e) = input.write_all(&data).await {
+                    log::error!("Failed to write to exec stdin: {}", e);
+                    break;
+                }
+            }
+        });
+
+        let session = ExecSession {
+            exec_id,
+            target: target.clone(),
+            input_tx,
+            shutdown_tx,
+        };
+
+        self.sessions
+            .lock()
+            .await
+            .insert(session_id.to_string(), session);
+
+        Ok(())
+    }
+
+    pub async fn send_input(&self, session_id: &str, data: Vec<u8>) -> Result<(), String> {
+        let sessions = self.sessions.lock().await;
+        let session = sessions
+            .get(session_id)
+            .ok_or_else(|| format!("Session {} not found", session_id))?;
+        session.send_input(data).await
+    }
+
+    pub async fn resize(&self, session_id: &str, cols: u16, rows: u16) -> Result<(), String> {
+        // Clone the exec_id under the lock, then drop the lock before the
+        // async host call to avoid holding the mutex across await.
+        let (exec_id, target) = {
+            let sessions = self.sessions.lock().await;
+            let session = sessions
+                .get(session_id)
+                .ok_or_else(|| format!("Session {} not found", session_id))?;
+            (session.exec_id.clone(), session.target.clone())
+        };
+        target.resize_exec(&exec_id, cols, rows).await
+    }
+
+    pub async fn close_session(&self, session_id: &str) {
+        let mut sessions = self.sessions.lock().await;
+        if let Some(session) = sessions.remove(session_id) {
+            session.shutdown();
+        }
+    }
+
+    pub async fn close_sessions_for_container(&self, container_id: &str) {
+        let mut sessions = self.sessions.lock().await;
+        let ids_to_close: Vec<String> = sessions
+            .iter()
+            .filter(|(_, s)| s.target.id() == container_id)
+            .map(|(id, _)| id.clone())
+            .collect();
+        for id in ids_to_close {
+            if let Some(session) = sessions.remove(&id) {
+                session.shutdown();
+            }
+        }
+    }
+
+    pub async fn close_all_sessions(&self) {
+        let mut sessions = self.sessions.lock().await;
+        for (_, session) in sessions.drain() {
+            session.shutdown();
+        }
+    }
+
+    /// The container a session was opened on — reuse it for side-channel work
+    /// on the same session (image paste, file drop, audio bridge) rather than
+    /// rebuilding a target from an id, which would assume the host.
+    pub async fn get_target(&self, session_id: &str) -> Result<ContainerTarget, String> {
+        let sessions = self.sessions.lock().await;
+        let session = sessions
+            .get(session_id)
+            .ok_or_else(|| format!("Session {} not found", session_id))?;
+        Ok(session.target.clone())
+    }
+
+    pub async fn write_file_to_container(
+        &self,
+        target: &ContainerTarget,
+        file_name: &str,
+        data: &[u8],
+    ) -> Result<String, String> {
+        // Owned by the container user, stamped now: a default tar header would
+        // land it as root:root/1970 and Claude Code could not rewrite it.
+        let ids = target.user_ids().await;
+        target
+            .upload_bytes_with_ids("/tmp", file_name, data, 0o644, ids)
+            .await
+    }
+}

app/src-tauri/src/host/ssm.rs

@@ -0,0 +1,851 @@
+//! The transport to an agent in an ECS task: one SSM port-forwarding session
+//! (`AWS-StartPortForwardingSession`) from a loopback port on this machine to
+//! the agent's port inside the task, kept open for as long as the project is
+//! connected and reopened when it drops. Everything else — execs, files,
+//! tunnels — then goes through [`AgentEndpoint`] exactly as it does locally.
+//! Design: `docs/superpowers/specs/2026-11-13-aws-ecs-host-design.md`
+//! ("Connectivity").
+//!
+//! The SSM data channel is a custom websocket protocol the Rust SDK does not
+//! implement, so v1 runs AWS's `session-manager-plugin` as a child process,
+//! the way the AWS CLI does: the app calls `ssm:StartSession` itself and hands
+//! the plugin the stream URL and token.
+//!
+//! Three things here are deliberate:
+//!
+//! - **The session token never goes on a command line.** The plugin reads the
+//!   `StartSession` response from the environment variable named by its first
+//!   argument (`AWS_SSM_START_SESSION_RESPONSE`, what the AWS CLI does for
+//!   plugins that support it), so it is not visible in `ps`.
+//! - **The plugin gets the caller's current credentials in its environment,
+//!   and nothing else of AWS's.** It needs them only to resume its data
+//!   channel after a network blip (`ssm:ResumeSession`), which keeps every TCP
+//!   connection through the tunnel — open terminals included — alive. Any
+//!   `AWS_*` variable this process happens to have is removed first, so the
+//!   plugin can never act as a different identity than the one that started
+//!   the session. When those credentials have expired a resume fails, the
+//!   plugin exits, and the supervisor here opens a fresh session with fresh
+//!   credentials on the **same local port**, so an [`AgentEndpoint`] built
+//!   once stays valid across reconnects (open connections do not survive that
+//!   path; new ones succeed).
+//! - **Whoever holds a [`PortForward`] must `close()` it when the app exits.**
+//!   Tauri exits through `std::process::exit`, which drops no runtime tasks,
+//!   so `kill_on_drop` never fires and the plugin would keep the session and
+//!   the port until SSM's idle timeout.
+//! - **The plugin listens on `127.0.0.1` only** (checked: plugin 1.2.896), and
+//!   the agent behind it still wants its bearer token. The SSM session's IAM
+//!   check is the outer gate.
+
+use aws_config::SdkConfig;
+use std::future::Future;
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+use tokio::io::{AsyncBufReadExt, AsyncRead, BufReader};
+use tokio::process::{Child, Command};
+use tokio::sync::watch;
+use tokio_util::sync::{CancellationToken, DropGuard};
+use zeroize::Zeroizing;
+
+use super::AgentEndpoint;
+
+/// Where `triple-c-agent` listens inside the task (its default).
+pub const AGENT_PORT: u16 = 47900;
+
+const PORT_FORWARD_DOCUMENT: &str = "AWS-StartPortForwardingSession";
+/// The environment variable the plugin reads the `StartSession` response from.
+const RESPONSE_ENV: &str = "AWS_SSM_START_SESSION_RESPONSE";
+/// What the plugin prints once its local listener is up.
+const READY_LINE: &str = "Waiting for connections";
+/// Plugin start to listener up. Measured at ~1-2 s; this bounds a wedged one.
+const READY_TIMEOUT: Duration = if cfg!(test) {
+    Duration::from_secs(2)
+} else {
+    Duration::from_secs(30)
+};
+/// The last lines of plugin output kept for error messages.
+const OUTPUT_TAIL_LINES: usize = 20;
+/// Reconnect delays; the last repeats. A reconnect that keeps failing for
+/// about ten minutes gives up ([`TunnelState::Failed`]) — by then the task is
+/// gone or the credentials need the user, and the host layer decides what the
+/// project's state is.
+const RECONNECT_BACKOFF: &[Duration] = &[
+    Duration::from_secs(1),
+    Duration::from_secs(2),
+    Duration::from_secs(5),
+    Duration::from_secs(10),
+    Duration::from_secs(30),
+];
+const MAX_RECONNECT_ATTEMPTS: u32 = 25;
+/// Attempts to find a free local port for the first connection.
+const INITIAL_PORT_ATTEMPTS: u32 = 3;
+const TERMINATE_TIMEOUT: Duration = Duration::from_secs(5);
+/// How often an Up tunnel sends traffic of its own. Session Manager ends a
+/// session after 20 minutes with no data (its default `idleSessionTimeout`;
+/// measured: a silent tunnel was cut at 19.7 min), and with it every TCP
+/// connection inside — an idle terminal tab included.
+const KEEPALIVE_INTERVAL: Duration = if cfg!(test) {
+    Duration::from_millis(200)
+} else {
+    Duration::from_secs(5 * 60)
+};
+const KEEPALIVE_TIMEOUT: Duration = Duration::from_secs(10);
+
+// ── The task ─────────────────────────────────────────────────────────────────
+
+/// An ECS task container that an SSM session can target.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct EcsTask {
+    /// The cluster's *name* (the SSM target wants the name, not the ARN).
+    pub cluster: String,
+    pub task_id: String,
+    /// The container's runtime id, from `DescribeTasks`.
+    pub runtime_id: String,
+}
+
+impl EcsTask {
+    /// `ecs:<cluster>_<taskId>_<runtimeId>`, the SSM target for one container
+    /// of one task.
+    pub fn ssm_target(&self) -> String {
+        format!("ecs:{}_{}_{}", self.cluster, self.task_id, self.runtime_id)
+    }
+
+    /// Look up `container` in `task` (an id or ARN) on `cluster` (a name or
+    /// ARN), and check it can take a session now: the task is running and
+    /// its ECS Exec agent is up. Fargate starts that agent a few seconds after
+    /// the container, so "not ready yet" is a normal answer just after start.
+    ///
+    /// The AWS host builds its target from `aws::tasks::wait_ready`'s answer
+    /// instead (`aws_host::ecs_task`); this stays for the live tests.
+    #[allow(dead_code)]
+    pub async fn resolve(
+        ecs: &aws_sdk_ecs::Client,
+        cluster: &str,
+        task: &str,
+        container: &str,
+    ) -> Result<Self, String> {
+        let cluster_name = last_arn_segment(cluster, "cluster/");
+        let out = ecs
+            .describe_tasks()
+            .cluster(cluster)
+            .tasks(task)
+            .send()
+            .await
+            .map_err(|e| format!("Could not look up the ECS task: {}", sdk_error(&e)))?;
+        let t = out
+            .tasks()
+            .first()
+            .ok_or_else(|| format!("ECS task {task} was not found in cluster {cluster_name}"))?;
+        let task_arn = t.task_arn().unwrap_or(task);
+        let task_id = last_arn_segment(task_arn, "/").to_string();
+        let status = t.last_status().unwrap_or("UNKNOWN");
+        if status != "RUNNING" {
+            return Err(format!("ECS task {task_id} is {status}, not RUNNING"));
+        }
+        let c = t
+            .containers()
+            .iter()
+            .find(|c| c.name() == Some(container))
+            .ok_or_else(|| format!("ECS task {task_id} has no container named {container}"))?;
+        let runtime_id = c
+            .runtime_id()
+            .ok_or_else(|| format!("Container {container} in task {task_id} has no runtime id yet"))?
+            .to_string();
+        let exec_agent = c
+            .managed_agents()
+            .iter()
+            .find(|a| a.name().map(|n| n.as_str()) == Some("ExecuteCommandAgent"));
+        match exec_agent.and_then(|a| a.last_status()) {
+            Some("RUNNING") => {}
+            Some(s) => {
+                return Err(format!(
+                    "Container {container} in task {task_id} is not ready for connections yet (ECS Exec agent {s})"
+                ))
+            }
+            None => {
+                return Err(format!(
+                    "ECS task {task_id} was started without ECS Exec, so it cannot be connected to"
+                ))
+            }
+        }
+        Ok(Self {
+            cluster: cluster_name.to_string(),
+            task_id,
+            runtime_id,
+        })
+    }
+}
+
+/// The part of an ARN after the last `marker` (`.../cluster/name` → `name`),
+/// or the whole string when it is not an ARN.
+#[allow(dead_code)] // `EcsTask::resolve`
+fn last_arn_segment<'a>(s: &'a str, marker: &str) -> &'a str {
+    if !s.starts_with("arn:") {
+        return s;
+    }
+    match s.rfind(marker) {
+        Some(i) => &s[i + marker.len()..],
+        None => s,
+    }
+}
+
+/// An SDK error with its cause chain (the bare `Display` is often just
+/// "service error").
+fn sdk_error(e: &(dyn std::error::Error + 'static)) -> String {
+    format!("{}", aws_sdk_ssm::error::DisplayErrorContext(e))
+}
+
+// ── The plugin ───────────────────────────────────────────────────────────────
+
+/// Find `session-manager-plugin`: `TRIPLEC_SSM_PLUGIN` if set, then `PATH`,
+/// then where AWS's installers put it (the GUI app on macOS does not get the
+/// shell's `PATH`, so the install locations are not optional).
+pub fn find_plugin() -> Result<PathBuf, String> {
+    if let Some(p) = std::env::var_os("TRIPLEC_SSM_PLUGIN").filter(|p| !p.is_empty()) {
+        let p = PathBuf::from(p);
+        return if p.is_file() {
+            Ok(p)
+        } else {
+            Err(format!("TRIPLEC_SSM_PLUGIN names {}, which is not a file", p.display()))
+        };
+    }
+    let name = if cfg!(windows) { "session-manager-plugin.exe" } else { "session-manager-plugin" };
+    let on_path = std::env::var_os("PATH")
+        .map(|paths| std::env::split_paths(&paths).map(|d| d.join(name)).collect::<Vec<_>>())
+        .unwrap_or_default();
+    let installed: Vec<PathBuf> = if cfg!(windows) {
+        ["ProgramFiles", "ProgramFiles(x86)"]
+            .iter()
+            .filter_map(|v| std::env::var_os(v))
+            .map(|d| PathBuf::from(d).join(r"Amazon\SessionManagerPlugin\bin").join(name))
+            .collect()
+    } else {
+        [
+            "/usr/local/sessionmanagerplugin/bin",
+            "/usr/local/bin",
+            "/opt/homebrew/bin",
+            "/usr/bin",
+        ]
+        .iter()
+        .map(|d| Path::new(d).join(name))
+        .collect()
+    };
+    on_path
+        .into_iter()
+        .chain(installed)
+        .find(|p| p.is_file())
+        .ok_or_else(|| {
+            "The AWS Session Manager plugin (session-manager-plugin) is not installed. It is \
+             what connects to a workspace on AWS; install it from \
+             https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html"
+                .to_string()
+        })
+}
+
+/// A running plugin process with a listener on the local port.
+struct Running {
+    child: Child,
+    session_id: String,
+    output: OutputTail,
+}
+
+/// The last lines a plugin printed (stdout and stderr), for error text.
+#[derive(Clone, Default)]
+struct OutputTail(Arc<Mutex<Vec<String>>>);
+
+impl OutputTail {
+    fn push(&self, line: String) {
+        let mut v = self.0.lock().unwrap();
+        v.push(line);
+        if v.len() > OUTPUT_TAIL_LINES {
+            v.remove(0);
+        }
+    }
+
+    /// The most informative recent line: the last non-blank one.
+    fn last(&self) -> Option<String> {
+        self.0.lock().unwrap().iter().rev().find(|l| !l.trim().is_empty()).cloned()
+    }
+
+    fn joined(&self) -> String {
+        self.0
+            .lock()
+            .unwrap()
+            .iter()
+            .filter(|l| !l.trim().is_empty())
+            .cloned()
+            .collect::<Vec<_>>()
+            .join("; ")
+    }
+}
+
+/// How to start the plugin for one session. Everything but `env_secret` is
+/// safe to log; that is the `StartSession` response.
+struct PluginLaunch {
+    program: PathBuf,
+    args: Vec<String>,
+    env: Vec<(String, Zeroizing<String>)>,
+    session_id: String,
+}
+
+/// Start the plugin and wait until it says its listener is up. Its output is
+/// then drained in the background for good (a full pipe would stall it).
+async fn spawn_plugin(launch: PluginLaunch) -> Result<Running, String> {
+    let mut cmd = Command::new(&launch.program);
+    cmd.args(&launch.args)
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .kill_on_drop(true);
+    // Only the credentials this session was started with: nothing AWS-shaped
+    // from our own environment rides along.
+    for (k, _) in std::env::vars_os() {
+        if k.to_string_lossy().starts_with("AWS_") {
+            cmd.env_remove(&k);
+        }
+    }
+    for (k, v) in &launch.env {
+        cmd.env(k, v.as_str());
+    }
+    #[cfg(windows)]
+    {
+        // CREATE_NO_WINDOW: no console flashing up per (re)connect.
+        cmd.creation_flags(0x0800_0000);
+    }
+    let mut child = cmd
+        .spawn()
+        .map_err(|e| format!("Could not start {}: {e}", launch.program.display()))?;
+
+    let output = OutputTail::default();
+    let (ready_tx, mut ready_rx) = watch::channel(false);
+    let stdout = child.stdout.take().expect("stdout is piped");
+    let stderr = child.stderr.take().expect("stderr is piped");
+    drain(stdout, output.clone(), Some(ready_tx));
+    drain(stderr, output.clone(), None);
+
+    let ready = async {
+        loop {
+            if *ready_rx.borrow_and_update() {
+                return true;
+            }
+            if ready_rx.changed().await.is_err() {
+                // stdout closed without the ready line: the plugin is exiting.
+                return *ready_rx.borrow();
+            }
+        }
+    };
+    tokio::select! {
+        r = tokio::time::timeout(READY_TIMEOUT, ready) => match r {
+            Ok(true) => Ok(Running { child, session_id: launch.session_id, output }),
+            Ok(false) => {
+                let _ = child.wait().await;
+                Err(plugin_failed(&output))
+            }
+            Err(_) => {
+                let _ = child.kill().await;
+                Err(format!(
+                    "The SSM port forward did not come up within {} s ({})",
+                    READY_TIMEOUT.as_secs(),
+                    output.joined()
+                ))
+            }
+        },
+        // Exited before (or without) printing the ready line.
+        status = child.wait() => {
+            // Let the drains catch the last lines before reporting them.
+            tokio::time::sleep(Duration::from_millis(50)).await;
+            let _ = status;
+            Err(plugin_failed(&output))
+        }
+    }
+}
+
+fn plugin_failed(output: &OutputTail) -> String {
+    match output.joined() {
+        s if s.is_empty() => "The SSM port forward exited before it was ready".to_string(),
+        s => format!("The SSM port forward exited before it was ready: {s}"),
+    }
+}
+
+fn drain(
+    stream: impl AsyncRead + Unpin + Send + 'static,
+    tail: OutputTail,
+    ready: Option<watch::Sender<bool>>,
+) {
+    tokio::spawn(async move {
+        let mut lines = BufReader::new(stream).lines();
+        while let Ok(Some(line)) = lines.next_line().await {
+            log::debug!("session-manager-plugin: {line}");
+            if let Some(tx) = &ready {
+                if line.contains(READY_LINE) {
+                    let _ = tx.send(true);
+                }
+            }
+            tail.push(line);
+        }
+        // `ready` drops here; a waiter sees the channel close.
+    });
+}
+
+// ── Opening sessions ─────────────────────────────────────────────────────────
+
+/// Opens and ends sessions. The real one calls SSM and runs the plugin; tests
+/// substitute a fake plugin without AWS.
+trait SessionOpener: Send + Sync + 'static {
+    fn open(&self, local_port: u16) -> impl Future<Output = Result<Running, String>> + Send;
+    fn terminate(&self, session_id: String) -> impl Future<Output = ()> + Send;
+}
+
+struct SsmOpener {
+    sdk: SdkConfig,
+    /// The credentials last handed to the plugin, reused until they near
+    /// expiry. Each fetch from the provider can be a `credential_process`
+    /// (an MFA or biometric prompt), an STS call or an SSO call, and the
+    /// provider in `SdkConfig` is not the SDK's cached one.
+    plugin_creds: tokio::sync::Mutex<Option<aws_sdk_ssm::config::Credentials>>,
+    ssm: aws_sdk_ssm::Client,
+    region: String,
+    plugin: PathBuf,
+    target: String,
+    remote_port: u16,
+}
+
+impl SessionOpener for SsmOpener {
+    async fn open(&self, local_port: u16) -> Result<Running, String> {
+        let out = self
+            .ssm
+            .start_session()
+            .target(&self.target)
+            .document_name(PORT_FORWARD_DOCUMENT)
+            .parameters("portNumber", vec![self.remote_port.to_string()])
+            .parameters("localPortNumber", vec![local_port.to_string()])
+            .send()
+            .await
+            .map_err(|e| format!("Could not start the SSM session: {}", sdk_error(&e)))?;
+        let session_id = out.session_id().unwrap_or_default().to_string();
+        // From here the session exists on AWS's side. If this future is
+        // dropped before it returns — a close or drop racing a reconnect, a
+        // caller timing out the first open — the guard ends the session.
+        let guard = SessionGuard {
+            ssm: self.ssm.clone(),
+            session_id: Some(session_id.clone()),
+        };
+        let response = Zeroizing::new(
+            serde_json::json!({
+                "SessionId": session_id,
+                "StreamUrl": out.stream_url().unwrap_or_default(),
+                "TokenValue": out.token_value().unwrap_or_default(),
+            })
+            .to_string(),
+        );
+        let request = serde_json::json!({
+            "Target": self.target,
+            "DocumentName": PORT_FORWARD_DOCUMENT,
+            "Parameters": {
+                "portNumber": [self.remote_port.to_string()],
+                "localPortNumber": [local_port.to_string()],
+            },
+        })
+        .to_string();
+
+        let mut env = vec![
+            (RESPONSE_ENV.to_string(), response),
+            ("AWS_REGION".to_string(), Zeroizing::new(self.region.clone())),
+        ];
+        env.extend(self.plugin_credentials().await);
+
+        let launch = PluginLaunch {
+            program: self.plugin.clone(),
+            // <response env var> <region> StartSession <profile> <request> <endpoint>:
+            // what the AWS CLI passes. No profile: credentials come from env.
+            args: vec![
+                RESPONSE_ENV.to_string(),
+                self.region.clone(),
+                "StartSession".to_string(),
+                String::new(),
+                request,
+                ssm_endpoint(&self.region),
+            ],
+            env,
+            session_id: session_id.clone(),
+        };
+        match spawn_plugin(launch).await {
+            Ok(r) => {
+                guard.disarm();
+                Ok(r)
+            }
+            Err(e) => {
+                // No plugin is attached to the session; don't leave it open
+                // until the idle timeout.
+                guard.terminate().await;
+                Err(e)
+            }
+        }
+    }
+
+    async fn terminate(&self, session_id: String) {
+        terminate_session(&self.ssm, session_id).await
+    }
+}
+
+async fn terminate_session(ssm: &aws_sdk_ssm::Client, session_id: String) {
+    if session_id.is_empty() {
+        return;
+    }
+    let call = ssm.terminate_session().session_id(&session_id).send();
+    match tokio::time::timeout(TERMINATE_TIMEOUT, call).await {
+        Ok(Ok(_)) => {}
+        Ok(Err(e)) => log::warn!("TerminateSession {session_id}: {}", sdk_error(&e)),
+        Err(_) => log::warn!("TerminateSession {session_id}: timed out"),
+    }
+}
+
+/// Ends a started session unless disarmed: on an error path explicitly, and
+/// on drop (a cancelled open) from a spawned task.
+struct SessionGuard {
+    ssm: aws_sdk_ssm::Client,
+    session_id: Option<String>,
+}
+
+impl SessionGuard {
+    fn disarm(mut self) {
+        self.session_id = None;
+    }
+
+    async fn terminate(mut self) {
+        if let Some(id) = self.session_id.take() {
+            terminate_session(&self.ssm, id).await;
+        }
+    }
+}
+
+impl Drop for SessionGuard {
+    fn drop(&mut self) {
+        if let Some(id) = self.session_id.take() {
+            if let Ok(rt) = tokio::runtime::Handle::try_current() {
+                let ssm = self.ssm.clone();
+                rt.spawn(async move { terminate_session(&ssm, id).await });
+            }
+        }
+    }
+}
+
+/// How long before expiry cached plugin credentials are refreshed. A plugin
+/// started with them may need them for a resume well after it starts.
+const PLUGIN_CREDS_MIN_REMAINING: Duration = Duration::from_secs(15 * 60);
+
+impl SsmOpener {
+    /// The caller's credentials as the plugin's environment, for its own
+    /// `ResumeSession` calls. Without them a resume fails and the
+    /// supervisor's full reconnect takes over, so a failure here is not fatal.
+    async fn plugin_credentials(&self) -> Vec<(String, Zeroizing<String>)> {
+        use aws_sdk_ssm::config::ProvideCredentials;
+        let mut cached = self.plugin_creds.lock().await;
+        let fresh = |c: &aws_sdk_ssm::config::Credentials| match c.expiry() {
+            None => true,
+            Some(exp) => exp
+                .duration_since(std::time::SystemTime::now())
+                .map(|left| left > PLUGIN_CREDS_MIN_REMAINING)
+                .unwrap_or(false),
+        };
+        if !cached.as_ref().is_some_and(fresh) {
+            *cached = None;
+            if let Some(provider) = self.sdk.credentials_provider() {
+                match provider.provide_credentials().await {
+                    Ok(c) => *cached = Some(c),
+                    Err(e) => log::warn!("No credentials for the SSM plugin's resume: {}", sdk_error(&e)),
+                }
+            }
+        }
+        let Some(c) = cached.as_ref() else {
+            return vec![];
+        };
+        let mut v = vec![
+            ("AWS_ACCESS_KEY_ID".to_string(), Zeroizing::new(c.access_key_id().to_string())),
+            (
+                "AWS_SECRET_ACCESS_KEY".to_string(),
+                Zeroizing::new(c.secret_access_key().to_string()),
+            ),
+        ];
+        if let Some(t) = c.session_token() {
+            v.push(("AWS_SESSION_TOKEN".to_string(), Zeroizing::new(t.to_string())));
+        }
+        v
+    }
+}
+
+fn ssm_endpoint(region: &str) -> String {
+    let suffix = if region.starts_with("cn-") { "amazonaws.com.cn" } else { "amazonaws.com" };
+    format!("https://ssm.{region}.{suffix}")
+}
+
+/// A free loopback port, for the plugin to bind. The plugin binds it a moment
+/// later, so another process can take it in between; the first connection
+/// retries with a new port when that happens.
+fn free_local_port() -> Result<u16, String> {
+    std::net::TcpListener::bind(("127.0.0.1", 0))
+        .and_then(|l| l.local_addr())
+        .map(|a| a.port())
+        .map_err(|e| format!("Could not find a free local port: {e}"))
+}
+
+// ── The port forward ─────────────────────────────────────────────────────────
+
+/// Where the tunnel is. Watch it with [`PortForward::state`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum TunnelState {
+    Up,
+    /// The session dropped and is being reopened. `last_error` is why the
+    /// previous one ended or the previous attempt failed.
+    Reconnecting { attempt: u32, last_error: String },
+    /// Reconnecting gave up. Nothing listens on the local port.
+    Failed(String),
+    /// [`PortForward::close`] ran, or the handle was dropped.
+    Closed,
+}
+
+/// One SSM port-forward to an agent, supervised: reopened on the same local
+/// port when it drops, ended (`TerminateSession`) when this handle is closed
+/// or dropped.
+pub struct PortForward {
+    local_port: u16,
+    state: watch::Receiver<TunnelState>,
+    #[allow(dead_code)] // `plugin_pid()`, for diagnostics and the tests
+    plugin_pid: watch::Receiver<Option<u32>>,
+    supervisor: Option<tokio::task::JoinHandle<()>>,
+    _cancel: DropGuard,
+    cancel: CancellationToken,
+}
+
+impl std::fmt::Debug for PortForward {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("PortForward")
+            .field("local_port", &self.local_port)
+            .field("state", &*self.state.borrow())
+            .finish()
+    }
+}
+
+impl PortForward {
+    /// Open a port forward from a free loopback port to `remote_port` in
+    /// `task`, and return once the local listener is up. Errors (no plugin,
+    /// IAM denial, the task not reachable) come back here rather than as a
+    /// state.
+    pub async fn open(sdk: &SdkConfig, task: &EcsTask, remote_port: u16) -> Result<Self, String> {
+        let region = sdk
+            .region()
+            .ok_or("No AWS region is configured for this connection")?
+            .to_string();
+        let opener = SsmOpener {
+            sdk: sdk.clone(),
+            plugin_creds: Default::default(),
+            ssm: aws_sdk_ssm::Client::new(sdk),
+            region,
+            plugin: find_plugin()?,
+            target: task.ssm_target(),
+            remote_port,
+        };
+        Self::open_with(opener).await
+    }
+
+    async fn open_with<O: SessionOpener>(opener: O) -> Result<Self, String> {
+        let mut last_err = String::new();
+        for _ in 0..INITIAL_PORT_ATTEMPTS {
+            let port = free_local_port()?;
+            match opener.open(port).await {
+                Ok(running) => return Ok(Self::supervise(opener, port, running)),
+                Err(e) if is_port_in_use(&e) => last_err = e,
+                Err(e) => return Err(e),
+            }
+        }
+        Err(last_err)
+    }
+
+    fn supervise<O: SessionOpener>(opener: O, local_port: u16, running: Running) -> Self {
+        let (state_tx, state) = watch::channel(TunnelState::Up);
+        let (pid_tx, plugin_pid) = watch::channel(running.child.id());
+        let cancel = CancellationToken::new();
+        let supervisor = tokio::spawn(run_supervisor(
+            opener,
+            local_port,
+            running,
+            state_tx,
+            pid_tx,
+            cancel.clone(),
+        ));
+        Self {
+            local_port,
+            state,
+            plugin_pid,
+            supervisor: Some(supervisor),
+            _cancel: cancel.clone().drop_guard(),
+            cancel,
+        }
+    }
+
+    #[allow(dead_code)] // diagnostics and the tests (Task 8 may show the state)
+    pub fn local_port(&self) -> u16 {
+        self.local_port
+    }
+
+    /// The agent at the local end of this tunnel. Stays valid across
+    /// reconnects (the port does not change).
+    pub fn endpoint(&self, token: impl Into<String>) -> AgentEndpoint {
+        AgentEndpoint::loopback(self.local_port, token)
+    }
+
+    #[allow(dead_code)] // diagnostics and the tests (Task 8 may show the state)
+    pub fn state(&self) -> watch::Receiver<TunnelState> {
+        self.state.clone()
+    }
+
+    /// The running plugin's process id, if one is running.
+    #[allow(dead_code)] // diagnostics and the tests (Task 8 may show the state)
+    pub fn plugin_pid(&self) -> Option<u32> {
+        *self.plugin_pid.borrow()
+    }
+
+    /// Stop the plugin and end the session, and wait for both.
+    pub async fn close(mut self) {
+        self.cancel.cancel();
+        if let Some(s) = self.supervisor.take() {
+            let _ = s.await;
+        }
+    }
+}
+
+fn is_port_in_use(e: &str) -> bool {
+    let e = e.to_ascii_lowercase();
+    e.contains("address already in use") || e.contains("only one usage of each socket address")
+}
+
+async fn run_supervisor<O: SessionOpener>(
+    opener: O,
+    local_port: u16,
+    mut running: Running,
+    state: watch::Sender<TunnelState>,
+    pid: watch::Sender<Option<u32>>,
+    cancel: CancellationToken,
+) {
+    loop {
+        // ── Up: wait for the plugin to exit, or for close; keep it busy ──
+        let mut keepalive = tokio::time::interval_at(
+            tokio::time::Instant::now() + KEEPALIVE_INTERVAL,
+            KEEPALIVE_INTERVAL,
+        );
+        keepalive.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+        let exited = loop {
+            tokio::select! {
+                s = running.child.wait() => break s,
+                _ = keepalive.tick() => {
+                    tokio::spawn(keepalive_probe(local_port));
+                }
+                _ = cancel.cancelled() => {
+                    let _ = running.child.kill().await;
+                    opener.terminate(running.session_id).await;
+                    let _ = pid.send(None);
+                    let _ = state.send(TunnelState::Closed);
+                    return;
+                }
+            }
+        };
+        let _ = pid.send(None);
+        // Let the drains catch the last lines.
+        tokio::time::sleep(Duration::from_millis(50)).await;
+        // Both halves: SSM's own reason is in the output ("timed out due to
+        // inactivity"), but after a kill the last line is just whatever the
+        // plugin printed before, so the exit status has to be there too.
+        let mut last_error = match running.output.last() {
+            Some(line) => format!("the SSM session ended ({}; last output: {line})", describe_exit(exited)),
+            None => format!("the SSM session ended ({})", describe_exit(exited)),
+        };
+        log::warn!("SSM port forward on 127.0.0.1:{local_port}: {last_error}; reconnecting");
+        opener.terminate(running.session_id).await;
+
+        // ── Reconnecting ──
+        let mut attempt = 0;
+        running = loop {
+            attempt += 1;
+            if attempt > MAX_RECONNECT_ATTEMPTS {
+                let _ = state.send(TunnelState::Failed(last_error));
+                // Nothing to clean up; wait for the handle to go.
+                cancel.cancelled().await;
+                let _ = state.send(TunnelState::Closed);
+                return;
+            }
+            let _ = state.send(TunnelState::Reconnecting {
+                attempt,
+                last_error: last_error.clone(),
+            });
+            let delay = reconnect_delay(attempt);
+            tokio::select! {
+                _ = tokio::time::sleep(delay) => {}
+                _ = cancel.cancelled() => {
+                    let _ = state.send(TunnelState::Closed);
+                    return;
+                }
+            }
+            let opened = tokio::select! {
+                r = opener.open(local_port) => r,
+                _ = cancel.cancelled() => {
+                    let _ = state.send(TunnelState::Closed);
+                    return;
+                }
+            };
+            match opened {
+                Ok(r) => break r,
+                Err(e) => {
+                    log::warn!("SSM port forward on 127.0.0.1:{local_port}: reconnect {attempt}: {e}");
+                    last_error = e;
+                }
+            }
+        };
+        let _ = pid.send(running.child.id());
+        let _ = state.send(TunnelState::Up);
+        log::info!("SSM port forward on 127.0.0.1:{local_port}: reconnected after {attempt} attempt(s)");
+    }
+}
+
+/// One request through the tunnel so SSM sees data: an *unauthenticated*
+/// `GET /v1/health`. The agent answers `401` before it counts anything as
+/// activity, so this keeps the session alive without keeping the workspace
+/// "in use" for idle auto-stop — and it needs no token here.
+async fn keepalive_probe(local_port: u16) {
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    let probe = async {
+        let mut s = tokio::net::TcpStream::connect(("127.0.0.1", local_port)).await?;
+        s.write_all(b"GET /v1/health HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n")
+            .await?;
+        let mut sink = [0u8; 512];
+        while s.read(&mut sink).await? > 0 {}
+        Ok::<_, std::io::Error>(())
+    };
+    match tokio::time::timeout(KEEPALIVE_TIMEOUT, probe).await {
+        Ok(Ok(())) => {}
+        Ok(Err(e)) => log::debug!("SSM keepalive on 127.0.0.1:{local_port}: {e}"),
+        Err(_) => log::debug!("SSM keepalive on 127.0.0.1:{local_port}: timed out"),
+    }
+}
+
+fn reconnect_delay(attempt: u32) -> Duration {
+    let d = RECONNECT_BACKOFF[(attempt as usize).saturating_sub(1).min(RECONNECT_BACKOFF.len() - 1)];
+    if cfg!(test) {
+        d / 100
+    } else {
+        d
+    }
+}
+
+fn describe_exit(s: std::io::Result<std::process::ExitStatus>) -> String {
+    match s {
+        Ok(s) => format!("plugin {s}"),
+        Err(e) => format!("plugin wait failed: {e}"),
+    }
+}
+
+#[cfg(test)]
+mod tests;
+
+#[cfg(test)]
+mod live_tests;

app/src-tauri/src/host/ssm/live_tests.rs

@@ -0,0 +1,192 @@
+//! The real thing: an SSM port forward to `triple-c-agent` in a running ECS
+//! task, used through `ContainerTarget::Agent` exactly as the app will.
+//!
+//! Ignored; needs AWS credentials (the default chain — profile, SSO or env),
+//! `session-manager-plugin`, and a task started with ECS Exec from an image
+//! that has the agent:
+//!
+//! - `TRIPLEC_SSM_E2E_CLUSTER`, `TRIPLEC_SSM_E2E_TASK` (name/id or ARN)
+//! - `TRIPLEC_SSM_E2E_TOKEN` — the agent token the task was given
+//! - `TRIPLEC_SSM_E2E_CONTAINER` — default `workspace`
+//! - `TRIPLEC_SSM_E2E_HOLD_MINUTES` — only for the hold test
+//!
+//! The SSM session's IAM gate is what these exercise against AWS; the agent's
+//! Docker parity is already pinned by `host::agent::live_tests`.
+
+use super::*;
+use crate::host::{ContainerTarget, ExecChunk};
+use futures_util::StreamExt;
+use std::time::Instant;
+use tokio::io::AsyncWriteExt;
+
+fn var(name: &str) -> String {
+    std::env::var(name).unwrap_or_else(|_| panic!("{name} is not set (see this file's header)"))
+}
+
+async fn connect() -> (PortForward, ContainerTarget, Duration) {
+    let sdk = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
+    let ecs = aws_sdk_ecs::Client::new(&sdk);
+    let container = std::env::var("TRIPLEC_SSM_E2E_CONTAINER").unwrap_or_else(|_| "workspace".into());
+    let task = EcsTask::resolve(&ecs, &var("TRIPLEC_SSM_E2E_CLUSTER"), &var("TRIPLEC_SSM_E2E_TASK"), &container)
+        .await
+        .expect("resolve the task");
+    let t0 = Instant::now();
+    let pf = PortForward::open(&sdk, &task, AGENT_PORT).await.expect("open the port forward");
+    let opened = t0.elapsed();
+    let target = ContainerTarget::Agent(pf.endpoint(var("TRIPLEC_SSM_E2E_TOKEN")));
+    (pf, target, opened)
+}
+
+async fn wait_up(pf: &PortForward, within: Duration) -> Duration {
+    let t0 = Instant::now();
+    let mut s = pf.state();
+    tokio::time::timeout(within, s.wait_for(|s| *s == TunnelState::Up))
+        .await
+        .expect("the tunnel did not come back")
+        .unwrap();
+    t0.elapsed()
+}
+
+async fn whoami(t: &ContainerTarget) -> Result<String, String> {
+    t.exec_oneshot(vec!["whoami".into()]).await.map(|s| s.trim().to_string())
+}
+
+#[tokio::test]
+#[ignore]
+async fn the_agent_works_through_an_ssm_port_forward_and_survives_a_drop() {
+    let (pf, t, opened) = connect().await;
+    eprintln!("port forward up in {opened:?} on 127.0.0.1:{}", pf.local_port());
+
+    // ── the operations the app uses ──
+    assert!(t.is_running().await.unwrap());
+    assert_eq!(whoami(&t).await.unwrap(), "claude");
+
+    let n = 20;
+    let t0 = Instant::now();
+    for _ in 0..n {
+        t.exec_oneshot(vec!["true".into()]).await.unwrap();
+    }
+    eprintln!("one-shot exec round trip: {:?} average over {n}", t0.elapsed() / n);
+
+    // attach with stdin
+    let mut exec = t
+        .attach(crate::host::ExecSpec::new(vec!["head".into(), "-n1".into()]))
+        .await
+        .unwrap();
+    exec.input.write_all(b"through ssm\n").await.unwrap();
+    exec.input.shutdown().await.unwrap();
+    let mut out = Vec::new();
+    while let Some(Ok(c)) = exec.output.next().await {
+        if let ExecChunk::StdOut(b) = c {
+            out.extend_from_slice(&b);
+        }
+    }
+    assert_eq!(String::from_utf8_lossy(&out), "through ssm\n");
+
+    // 4 MiB up and back
+    let data: Vec<u8> = (0..4 * 1024 * 1024u32).map(|i| (i % 251) as u8).collect();
+    let t0 = Instant::now();
+    t.upload_bytes_with_ids("/tmp", "ssm-e2e.bin", &data, 0o644, (1000, 1000)).await.unwrap();
+    let up = t0.elapsed();
+    let t0 = Instant::now();
+    let mut tar = Vec::new();
+    let mut s = t.download_archive("/tmp/ssm-e2e.bin");
+    while let Some(chunk) = s.next().await {
+        tar.extend_from_slice(&chunk.unwrap());
+    }
+    let down = t0.elapsed();
+    let mut a = tar::Archive::new(&tar[..]);
+    let mut e = a.entries().unwrap().next().unwrap().unwrap();
+    let mut back = Vec::new();
+    std::io::Read::read_to_end(&mut e, &mut back).unwrap();
+    assert!(back == data, "the file came back different");
+    eprintln!("4 MiB: upload {up:?}, download {down:?}");
+    t.exec_oneshot(vec!["rm".into(), "-f".into(), "/tmp/ssm-e2e.bin".into()]).await.unwrap();
+
+    // ── a dropped session: kill the plugin, as a crash or sleep would ──
+    let pid = pf.plugin_pid().unwrap();
+    std::process::Command::new("kill").args(["-9", &pid.to_string()]).status().unwrap();
+    let mut s = pf.state();
+    s.wait_for(|s| *s != TunnelState::Up).await.unwrap();
+    let back_in = wait_up(&pf, Duration::from_secs(60)).await;
+    eprintln!("reconnected in {back_in:?} (same port {})", pf.local_port());
+    assert_eq!(whoami(&t).await.unwrap(), "claude", "the same endpoint works after a reconnect");
+
+    // ── close ends it ──
+    let port = pf.local_port();
+    pf.close().await;
+    assert!(
+        std::net::TcpStream::connect(("127.0.0.1", port)).is_err(),
+        "something still listens on the closed tunnel's port"
+    );
+}
+
+/// Hold one tunnel for `TRIPLEC_SSM_E2E_HOLD_MINUTES` (default 60): a probe
+/// every minute for the first and last stretch, and a silent stretch in the
+/// middle longer than Session Manager's default 20-minute idle timeout. One
+/// attached exec stays open the whole time. Prints a timeline of tunnel
+/// states; fails only if the tunnel cannot serve a request at the end.
+#[tokio::test]
+#[ignore]
+async fn an_ssm_port_forward_holds_for_a_long_session() {
+    let minutes: u64 = std::env::var("TRIPLEC_SSM_E2E_HOLD_MINUTES")
+        .ok()
+        .and_then(|m| m.parse().ok())
+        .unwrap_or(60);
+    let (pf, t, opened) = connect().await;
+    let start = Instant::now();
+    let stamp = move || format!("[{:>5.1} min]", start.elapsed().as_secs_f64() / 60.0);
+    eprintln!("{} up in {opened:?}", stamp());
+
+    // Log every state change as it happens.
+    let mut states = pf.state();
+    let log_states = tokio::spawn(async move {
+        while states.changed().await.is_ok() {
+            eprintln!("{} tunnel: {:?}", stamp(), *states.borrow());
+        }
+    });
+
+    // A long-lived connection: does one TCP stream survive the whole hold?
+    let mut held = t.attach(crate::host::ExecSpec::new(vec!["cat".into()])).await.unwrap();
+
+    let idle_from = minutes / 4;
+    let idle_to = idle_from + 25.min(minutes / 2);
+    let mut failures = 0;
+    for m in 0..minutes {
+        if m < idle_from || m >= idle_to {
+            let t0 = Instant::now();
+            match whoami(&t).await {
+                Ok(_) => eprintln!("{} probe ok ({:?})", stamp(), t0.elapsed()),
+                Err(e) => {
+                    failures += 1;
+                    eprintln!("{} probe FAILED: {e}", stamp())
+                }
+            }
+        } else if m == idle_from {
+            eprintln!("{} silent until minute {idle_to}", stamp());
+        }
+        tokio::time::sleep(Duration::from_secs(60)).await;
+    }
+
+    // Did the held stream survive? Echo through it.
+    let survived = async {
+        held.input.write_all(b"still here\n").await.ok()?;
+        let mut got = Vec::new();
+        while let Ok(Some(Ok(c))) = tokio::time::timeout(Duration::from_secs(10), held.output.next()).await {
+            if let ExecChunk::StdOut(b) = c {
+                got.extend_from_slice(&b);
+                if got.ends_with(b"\n") {
+                    break;
+                }
+            }
+        }
+        Some(got == b"still here\n")
+    }
+    .await
+    .unwrap_or(false);
+    eprintln!("{} long-lived attach survived: {survived}; probe failures: {failures}", stamp());
+
+    assert_eq!(whoami(&t).await.unwrap(), "claude", "the tunnel serves at the end");
+    pf.close().await;
+    log_states.abort();
+}

app/src-tauri/src/host/ssm/tests.rs

@@ -0,0 +1,402 @@
+//! The plugin handling and the supervisor, against a fake plugin (a shell
+//! script) instead of AWS. The real thing is in `live_tests.rs`.
+
+use super::*;
+
+#[test]
+fn the_ssm_target_names_cluster_task_and_container_runtime() {
+    let t = EcsTask {
+        cluster: "triple-c".into(),
+        task_id: "9fb3a6cf".into(),
+        runtime_id: "9fb3a6cf-0791508406".into(),
+    };
+    assert_eq!(t.ssm_target(), "ecs:triple-c_9fb3a6cf_9fb3a6cf-0791508406");
+}
+
+#[test]
+fn arns_are_reduced_to_their_names() {
+    assert_eq!(
+        last_arn_segment("arn:aws:ecs:us-west-2:123456789012:cluster/triple-c", "cluster/"),
+        "triple-c"
+    );
+    assert_eq!(
+        last_arn_segment("arn:aws:ecs:us-west-2:123456789012:task/triple-c/9fb3a6cf", "/"),
+        "9fb3a6cf"
+    );
+    assert_eq!(last_arn_segment("triple-c", "cluster/"), "triple-c");
+    assert_eq!(last_arn_segment("9fb3a6cf", "/"), "9fb3a6cf");
+}
+
+#[test]
+fn the_plugin_endpoint_follows_the_partition() {
+    assert_eq!(ssm_endpoint("us-west-2"), "https://ssm.us-west-2.amazonaws.com");
+    assert_eq!(ssm_endpoint("cn-north-1"), "https://ssm.cn-north-1.amazonaws.com.cn");
+}
+
+#[test]
+fn a_port_clash_is_recognised_on_every_platform() {
+    assert!(is_port_in_use("listen tcp 127.0.0.1:4: bind: address already in use"));
+    assert!(is_port_in_use(
+        "bind: Only one usage of each socket address (protocol/network address/port) is normally permitted."
+    ));
+    assert!(!is_port_in_use("TargetNotConnected"));
+}
+
+#[test]
+fn backoff_grows_then_holds() {
+    assert!(reconnect_delay(1) < reconnect_delay(2));
+    assert_eq!(reconnect_delay(5), reconnect_delay(500));
+}
+
+#[cfg(unix)]
+mod with_a_fake_plugin {
+    use super::*;
+    use std::os::unix::fs::PermissionsExt;
+    use std::sync::atomic::{AtomicU32, Ordering};
+
+    /// A fake `session-manager-plugin`: a shell script.
+    fn script(dir: &Path, name: &str, body: &str) -> PathBuf {
+        let p = dir.join(name);
+        std::fs::write(&p, format!("#!/bin/sh\n{body}\n")).unwrap();
+        std::fs::set_permissions(&p, std::fs::Permissions::from_mode(0o755)).unwrap();
+        p
+    }
+
+    /// Runs the script as `/bin/sh <script>`: the script is only ever read,
+    /// never exec'd, so a parallel test's fork holding it open for writing
+    /// for a moment cannot fail the spawn with ETXTBSY ("Text file busy").
+    fn launch(script: PathBuf, secret: &str) -> PluginLaunch {
+        PluginLaunch {
+            program: "/bin/sh".into(),
+            args: vec![
+                script.display().to_string(),
+                RESPONSE_ENV.into(),
+                "us-west-2".into(),
+                "StartSession".into(),
+            ],
+            env: vec![(RESPONSE_ENV.into(), Zeroizing::new(secret.into()))],
+            session_id: "s-1".into(),
+        }
+    }
+
+    const READY: &str = "echo 'Port 1 opened for sessionId s.'; echo 'Waiting for connections...'";
+
+    #[tokio::test]
+    async fn the_session_token_travels_in_the_environment_never_on_the_command_line() {
+        let dir = tempfile::tempdir().unwrap();
+        let out = dir.path().join("seen");
+        // Nothing AWS-shaped from our own environment may reach the plugin.
+        // (A name no other test reads, so setting it here is not a race.)
+        std::env::set_var("AWS_TRIPLEC_SSM_TEST_LEAK", "leaked");
+        let p = script(
+            dir.path(),
+            "plugin",
+            &format!(
+                "echo \"argv=$*\" > {o}; echo \"env=${r}\" >> {o}; echo \"leak=$AWS_TRIPLEC_SSM_TEST_LEAK\" >> {o}; {READY}; exec sleep 30",
+                o = out.display(),
+                r = RESPONSE_ENV
+            ),
+        );
+        let running = spawn_plugin(launch(p, "the-secret-token")).await.expect("ready");
+        let seen = std::fs::read_to_string(&out).unwrap();
+        std::env::remove_var("AWS_TRIPLEC_SSM_TEST_LEAK");
+        assert!(seen.contains("env=the-secret-token"), "{seen}");
+        let argv = seen.lines().find(|l| l.starts_with("argv=")).unwrap();
+        assert!(!argv.contains("the-secret-token"), "{argv}");
+        assert!(argv.contains(RESPONSE_ENV), "the plugin is told which variable to read: {argv}");
+        assert!(seen.contains("leak=\n"), "{seen}");
+        drop(running); // kill_on_drop
+    }
+
+    #[tokio::test]
+    async fn a_plugin_that_exits_early_says_why() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = script(
+            dir.path(),
+            "plugin",
+            "echo 'An error occurred (TargetNotConnected) when calling the StartSession operation' >&2; exit 255",
+        );
+        let err = spawn_plugin(launch(p, "x")).await.err().expect("must fail");
+        assert!(err.contains("TargetNotConnected"), "{err}");
+    }
+
+    #[tokio::test]
+    async fn a_plugin_that_never_gets_ready_is_killed_and_reported() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = script(dir.path(), "plugin", "echo 'Starting session'; exec sleep 30");
+        let err = spawn_plugin(launch(p, "x")).await.err().expect("must time out");
+        assert!(err.contains("did not come up"), "{err}");
+        assert!(err.contains("Starting session"), "{err}");
+    }
+
+    /// Opens sessions by running a fake plugin; records what it was asked.
+    struct FakeOpener {
+        plugin: PathBuf,
+        ports: Arc<Mutex<Vec<u16>>>,
+        terminated: Arc<Mutex<Vec<String>>>,
+        opened: Arc<AtomicU32>,
+        /// Fail opens whose 1-based number is in here, with this message.
+        fail: Vec<(u32, &'static str)>,
+        /// Connections made to the local port (the fake plugin listens on
+        /// nothing, so the opener stands in for its listener).
+        connections: Arc<AtomicU32>,
+    }
+
+    impl FakeOpener {
+        fn new(plugin: PathBuf) -> Self {
+            Self {
+                plugin,
+                ports: Default::default(),
+                terminated: Default::default(),
+                opened: Default::default(),
+                fail: vec![],
+                connections: Default::default(),
+            }
+        }
+    }
+
+    impl SessionOpener for FakeOpener {
+        async fn open(&self, local_port: u16) -> Result<Running, String> {
+            let n = self.opened.fetch_add(1, Ordering::SeqCst) + 1;
+            self.ports.lock().unwrap().push(local_port);
+            if let Some((_, msg)) = self.fail.iter().find(|(i, _)| *i == n) {
+                return Err(msg.to_string());
+            }
+            if let Ok(listener) = tokio::net::TcpListener::bind(("127.0.0.1", local_port)).await {
+                let count = self.connections.clone();
+                tokio::spawn(async move {
+                    while let Ok((sock, _)) = listener.accept().await {
+                        count.fetch_add(1, Ordering::SeqCst);
+                        drop(sock);
+                    }
+                });
+            }
+            let mut l = launch(self.plugin.clone(), "x");
+            l.session_id = format!("s-{n}");
+            spawn_plugin(l).await
+        }
+
+        async fn terminate(&self, session_id: String) {
+            self.terminated.lock().unwrap().push(session_id);
+        }
+    }
+
+    async fn wait_for(state: &mut watch::Receiver<TunnelState>, want: impl Fn(&TunnelState) -> bool) -> TunnelState {
+        let s = tokio::time::timeout(Duration::from_secs(10), state.wait_for(|s| want(s)))
+            .await
+            .expect("state did not arrive")
+            .expect("supervisor gone")
+            .clone();
+        s
+    }
+
+    fn alive(pid: u32) -> bool {
+        std::process::Command::new("kill")
+            .args(["-0", &pid.to_string()])
+            .status()
+            .map(|s| s.success())
+            .unwrap_or(false)
+    }
+
+    fn kill(pid: u32) {
+        std::process::Command::new("kill").args(["-9", &pid.to_string()]).status().unwrap();
+    }
+
+    #[tokio::test]
+    async fn a_dropped_session_is_reopened_on_the_same_local_port() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = script(dir.path(), "plugin", &format!("{READY}; exec sleep 30"));
+        let opener = FakeOpener::new(p);
+        let (ports, terminated) = (opener.ports.clone(), opener.terminated.clone());
+
+        let pf = PortForward::open_with(opener).await.expect("open");
+        let mut state = pf.state();
+        assert_eq!(*state.borrow(), TunnelState::Up);
+        let first = pf.plugin_pid().expect("a plugin runs");
+
+        kill(first);
+        wait_for(&mut state, |s| matches!(s, TunnelState::Reconnecting { .. })).await;
+        wait_for(&mut state, |s| *s == TunnelState::Up).await;
+        let second = pf.plugin_pid().expect("a new plugin runs");
+        assert_ne!(first, second);
+
+        let ports = ports.lock().unwrap().clone();
+        assert_eq!(ports.len(), 2, "{ports:?}");
+        assert_eq!(ports[0], ports[1], "the endpoint must stay valid: same port");
+        assert_eq!(pf.local_port(), ports[0]);
+        assert_eq!(*terminated.lock().unwrap(), vec!["s-1".to_string()], "the dead session is ended");
+
+        pf.close().await;
+        assert!(!alive(second));
+    }
+
+    #[tokio::test]
+    async fn an_up_tunnel_keeps_itself_busy() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = script(dir.path(), "plugin", &format!("{READY}; exec sleep 30"));
+        let opener = FakeOpener::new(p);
+        let connections = opener.connections.clone();
+        let pf = PortForward::open_with(opener).await.expect("open");
+        tokio::time::sleep(KEEPALIVE_INTERVAL * 5 + KEEPALIVE_INTERVAL / 2).await;
+        let n = connections.load(Ordering::SeqCst);
+        assert!((3..=6).contains(&n), "{n} keepalives in 5.5 intervals");
+        pf.close().await;
+    }
+
+    #[tokio::test]
+    async fn close_kills_the_plugin_and_ends_the_session() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = script(dir.path(), "plugin", &format!("{READY}; exec sleep 30"));
+        let opener = FakeOpener::new(p);
+        let terminated = opener.terminated.clone();
+        let pf = PortForward::open_with(opener).await.expect("open");
+        let pid = pf.plugin_pid().unwrap();
+        let mut state = pf.state();
+        pf.close().await;
+        assert_eq!(*state.borrow_and_update(), TunnelState::Closed);
+        assert!(!alive(pid), "the plugin outlived close()");
+        assert_eq!(*terminated.lock().unwrap(), vec!["s-1".to_string()]);
+    }
+
+    #[tokio::test]
+    async fn dropping_the_handle_also_ends_the_session() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = script(dir.path(), "plugin", &format!("{READY}; exec sleep 30"));
+        let opener = FakeOpener::new(p);
+        let terminated = opener.terminated.clone();
+        let pf = PortForward::open_with(opener).await.expect("open");
+        let pid = pf.plugin_pid().unwrap();
+        let mut state = pf.state();
+        drop(pf);
+        wait_for(&mut state, |s| *s == TunnelState::Closed).await;
+        assert!(!alive(pid));
+        assert_eq!(*terminated.lock().unwrap(), vec!["s-1".to_string()]);
+    }
+
+    #[tokio::test]
+    async fn the_first_open_moves_off_a_port_someone_else_took() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = script(dir.path(), "plugin", &format!("{READY}; exec sleep 30"));
+        let mut opener = FakeOpener::new(p);
+        opener.fail = vec![(1, "listen tcp 127.0.0.1:1: bind: address already in use")];
+        let opened = opener.opened.clone();
+        let pf = PortForward::open_with(opener).await.expect("second port works");
+        assert_eq!(opened.load(Ordering::SeqCst), 2);
+        pf.close().await;
+    }
+
+    #[tokio::test]
+    async fn other_first_open_errors_are_returned_not_retried() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = script(dir.path(), "plugin", &format!("{READY}; exec sleep 30"));
+        let mut opener = FakeOpener::new(p);
+        opener.fail = vec![(1, "AccessDeniedException: not authorized to perform ssm:StartSession")];
+        let opened = opener.opened.clone();
+        let err = PortForward::open_with(opener).await.err().expect("must fail");
+        assert!(err.contains("AccessDenied"), "{err}");
+        assert_eq!(opened.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test]
+    async fn reconnecting_gives_up_after_the_limit_and_says_why() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = script(dir.path(), "plugin", &format!("{READY}; exec sleep 30"));
+        let mut opener = FakeOpener::new(p);
+        // Open 1 works; every reconnect after it fails.
+        opener.fail = (2..=MAX_RECONNECT_ATTEMPTS + 1)
+            .map(|i| (i, "TargetNotConnected: the task stopped"))
+            .collect();
+        let pf = PortForward::open_with(opener).await.expect("open");
+        let mut state = pf.state();
+        kill(pf.plugin_pid().unwrap());
+        let s = tokio::time::timeout(
+            Duration::from_secs(30),
+            state.wait_for(|s| matches!(s, TunnelState::Failed(_))),
+        )
+        .await
+        .expect("gave up")
+        .unwrap()
+        .clone();
+        assert_eq!(s, TunnelState::Failed("TargetNotConnected: the task stopped".into()));
+        assert_eq!(pf.plugin_pid(), None);
+        pf.close().await;
+        assert_eq!(*state.borrow_and_update(), TunnelState::Closed);
+    }
+}
+
+/// A cancelled open (its future dropped after `StartSession` succeeded) must
+/// still end the session: the guard's drop sends `TerminateSession`. Checked
+/// against a fake SSM endpoint that records what it is asked.
+#[tokio::test]
+async fn a_dropped_open_still_ends_its_session() {
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    let (seen_tx, mut seen_rx) = tokio::sync::mpsc::unbounded_channel::<String>();
+    tokio::spawn(async move {
+        loop {
+            let (mut sock, _) = listener.accept().await.unwrap();
+            let tx = seen_tx.clone();
+            tokio::spawn(async move {
+                let mut buf = vec![0u8; 64 * 1024];
+                let mut req = Vec::new();
+                // Headers and the small JSON body arrive together here.
+                while let Ok(n) = sock.read(&mut buf).await {
+                    if n == 0 {
+                        break;
+                    }
+                    req.extend_from_slice(&buf[..n]);
+                    let text = String::from_utf8_lossy(&req);
+                    if text.contains("SessionId") {
+                        break;
+                    }
+                }
+                let _ = tx.send(String::from_utf8_lossy(&req).into_owned());
+                let body = r#"{"SessionId":"s-dropped"}"#;
+                let resp = format!(
+                    "HTTP/1.1 200 OK\r\nContent-Type: application/x-amz-json-1.1\r\nContent-Length: {}\r\n\r\n{body}",
+                    body.len()
+                );
+                let _ = sock.write_all(resp.as_bytes()).await;
+            });
+        }
+    });
+
+    let conf = aws_sdk_ssm::Config::builder()
+        .behavior_version(aws_sdk_ssm::config::BehaviorVersion::latest())
+        .region(aws_sdk_ssm::config::Region::new("us-west-2"))
+        .credentials_provider(aws_sdk_ssm::config::Credentials::new("AKIDTEST", "secret", None, None, "test"))
+        .endpoint_url(format!("http://127.0.0.1:{port}"))
+        .build();
+    let guard = SessionGuard {
+        ssm: aws_sdk_ssm::Client::from_conf(conf),
+        session_id: Some("s-dropped".into()),
+    };
+    drop(guard);
+    let req = tokio::time::timeout(Duration::from_secs(10), seen_rx.recv())
+        .await
+        .expect("no TerminateSession arrived")
+        .unwrap();
+    assert!(req.contains("AmazonSSM.TerminateSession"), "{req}");
+    assert!(req.contains("s-dropped"), "{req}");
+}
+
+/// The keepalive is the unauthenticated health probe: some traffic, no token.
+#[tokio::test]
+async fn the_keepalive_asks_for_health_without_a_token() {
+    use tokio::io::AsyncReadExt;
+    use tokio::io::AsyncWriteExt;
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    let server = tokio::spawn(async move {
+        let (mut sock, _) = listener.accept().await.unwrap();
+        let mut buf = vec![0u8; 4096];
+        let n = sock.read(&mut buf).await.unwrap();
+        sock.write_all(b"HTTP/1.1 401 Unauthorized\r\ncontent-length: 0\r\n\r\n").await.unwrap();
+        String::from_utf8_lossy(&buf[..n]).into_owned()
+    });
+    keepalive_probe(port).await;
+    let req = server.await.unwrap();
+    assert!(req.starts_with("GET /v1/health HTTP/1.1\r\n"), "{req}");
+    assert!(!req.to_ascii_lowercase().contains("authorization"), "{req}");
+}

app/src-tauri/src/host/tunnels.rs

@@ -0,0 +1,480 @@
+//! The live SSM tunnels to AWS projects' agents, by project id.
+//!
+//! An AWS project's [`ContainerTarget`](super::ContainerTarget) is an agent
+//! endpoint at the loopback end of a [`PortForward`](super::ssm::PortForward);
+//! this registry is where `ContainerTarget::for_project` finds it, where
+//! `ProjectHost::stop` finds the task behind an endpoint, and what the
+//! shutdown path closes (every forward runs a `session-manager-plugin` child
+//! that would otherwise outlive the app — see `ssm.rs`).
+//!
+//! It also remembers which targets the AWS death watch found **stopped**, so
+//! `ContainerTarget::has_exited` can answer for an agent target (R3): only
+//! the host that runs the task can confirm a death, never the agent.
+
+use std::collections::{HashMap, HashSet};
+use std::sync::Mutex;
+use std::time::Duration;
+
+use aws_config::SdkConfig;
+use futures_util::future::BoxFuture;
+use tokio::sync::watch;
+
+use super::agent::AgentEndpoint;
+use crate::aws::tasks::StopKind;
+use super::ssm::{EcsTask, PortForward};
+
+/// Something that owns a tunnel's resources: the real [`PortForward`], or a
+/// test stand-in.
+pub trait TunnelHandle: Send + Sync {
+    fn close(self: Box<Self>) -> BoxFuture<'static, ()>;
+}
+
+impl TunnelHandle for PortForward {
+    fn close(self: Box<Self>) -> BoxFuture<'static, ()> {
+        Box::pin(async move { (*self).close().await })
+    }
+}
+
+/// One project's tunnel and the task it reaches.
+pub struct LiveTunnel {
+    /// The SSM target (kept for diagnostics; the forward already uses it).
+    #[allow(dead_code)]
+    pub task: EcsTask,
+    pub task_arn: String,
+    pub cluster_arn: String,
+    pub connection_id: String,
+    pub region: String,
+    /// The connection's SDK config, so a stop needs no settings lookup.
+    pub sdk: SdkConfig,
+    pub forward: Box<dyn TunnelHandle>,
+    pub endpoint: AgentEndpoint,
+    /// Runtime handles for the store (`set_aws_runtime`).
+    pub access_point_id: Option<String>,
+    pub task_definition_arn: String,
+}
+
+/// Where an endpoint's task is: `(connection, region, cluster, task ARN)`.
+pub type TaskOf = (String, String, String, String);
+
+#[derive(Default)]
+struct Registry {
+    live: HashMap<String, LiveTunnel>,
+    /// Target ids (endpoint base URLs) whose task the AWS watch saw STOPPED,
+    /// and why.
+    stopped: HashMap<String, StopKind>,
+    /// Projects whose tunnel is being re-opened in the background.
+    pending: HashSet<String>,
+    /// Bumped by every [`close`] (a stop or remove), every [`register`] (a
+    /// start's own tunnel) and [`cancel_reattach`]: a background re-attach
+    /// that began under an older generation must never register.
+    generation: HashMap<String, u64>,
+}
+
+fn registry() -> &'static Mutex<Registry> {
+    static R: std::sync::OnceLock<Mutex<Registry>> = std::sync::OnceLock::new();
+    R.get_or_init(Default::default)
+}
+
+fn lock() -> std::sync::MutexGuard<'static, Registry> {
+    registry().lock().unwrap_or_else(|e| e.into_inner())
+}
+
+/// Wakes [`wait_endpoint`] callers when the registry changes.
+fn changed() -> &'static watch::Sender<u64> {
+    static C: std::sync::OnceLock<watch::Sender<u64>> = std::sync::OnceLock::new();
+    C.get_or_init(|| watch::channel(0).0)
+}
+
+fn notify() {
+    changed().send_modify(|n| *n = n.wrapping_add(1));
+}
+
+/// The target id an AWS project has while no tunnel is registered for it
+/// (see `aws_host::unattached_container_id`): never a loopback URL, so a
+/// port a new tunnel reuses can't be confused with it.
+pub fn unattached_id(project_id: &str) -> String {
+    format!("http://unattached.invalid/{project_id}/")
+}
+
+/// Forget that the watch saw the task behind `target_id` stopped. For a
+/// project's [`unattached_id`], which (unlike an endpoint) is reused by
+/// every later unattached spell of the same project: a stale entry would
+/// make a later live task read as stopped.
+pub fn forget_stopped(target_id: &str) {
+    lock().stopped.remove(target_id);
+}
+
+/// Register `tunnel` for `project_id`, returning the one it replaces (the
+/// caller closes it).
+pub fn register(project_id: &str, tunnel: LiveTunnel) -> Option<LiveTunnel> {
+    let old = {
+        let mut r = lock();
+        *r.generation.entry(project_id.to_string()).or_default() += 1;
+        r.stopped.remove(tunnel.endpoint.base_url.as_str());
+        r.stopped.remove(&unattached_id(project_id));
+        r.pending.remove(project_id);
+        r.live.insert(project_id.to_string(), tunnel)
+    };
+    notify();
+    old
+}
+
+pub fn get_endpoint(project_id: &str) -> Option<AgentEndpoint> {
+    lock().live.get(project_id).map(|t| t.endpoint.clone())
+}
+
+/// `(task ARN, access point id, task definition ARN)` of the project's tunnel.
+pub fn runtime(project_id: &str) -> Option<(String, Option<String>, String)> {
+    lock().live.get(project_id).map(|t| {
+        (
+            t.task_arn.clone(),
+            t.access_point_id.clone(),
+            t.task_definition_arn.clone(),
+        )
+    })
+}
+
+/// The project whose tunnel is `ep` and its task.
+pub fn task_of(ep: &AgentEndpoint) -> Option<TaskOf> {
+    lock().live.values().find(|t| t.endpoint.base_url == ep.base_url).map(|t| {
+        (
+            t.connection_id.clone(),
+            t.region.clone(),
+            t.cluster_arn.clone(),
+            t.task_arn.clone(),
+        )
+    })
+}
+
+/// The project id and SDK config behind `ep`.
+pub(crate) fn owner_of(ep: &AgentEndpoint) -> Option<(String, SdkConfig)> {
+    lock()
+        .live
+        .iter()
+        .find(|(_, t)| t.endpoint.base_url == ep.base_url)
+        .map(|(id, t)| (id.clone(), t.sdk.clone()))
+}
+
+/// A background re-attach of `project_id` begins: marks it pending and
+/// returns the generation [`register_if_current`] must still see.
+pub fn begin_reattach(project_id: &str) -> u64 {
+    let g = {
+        let mut r = lock();
+        r.pending.insert(project_id.to_string());
+        *r.generation.entry(project_id.to_string()).or_default()
+    };
+    notify();
+    g
+}
+
+/// [`register`], unless the project was closed (stopped, removed) since
+/// `generation` was taken: then the tunnel is handed back for the caller to
+/// close, and nothing is registered.
+pub fn register_if_current(
+    project_id: &str,
+    generation: u64,
+    tunnel: LiveTunnel,
+) -> Result<Option<LiveTunnel>, Box<LiveTunnel>> {
+    let old = {
+        let mut r = lock();
+        if r.generation.get(project_id).copied().unwrap_or_default() != generation {
+            return Err(Box::new(tunnel));
+        }
+        r.stopped.remove(tunnel.endpoint.base_url.as_str());
+        r.stopped.remove(&unattached_id(project_id));
+        r.pending.remove(project_id);
+        r.live.insert(project_id.to_string(), tunnel)
+    };
+    notify();
+    Ok(old)
+}
+
+/// [`close`], but only when the registered tunnel leads to `task_arn` (a
+/// death report about an older task must not close a newer one's tunnel).
+pub async fn close_if_task(project_id: &str, task_arn: &str) {
+    let taken = {
+        let mut r = lock();
+        if !r.live.get(project_id).is_some_and(|t| t.task_arn == task_arn) {
+            return;
+        }
+        take(&mut r, project_id)
+    };
+    notify();
+    if let Some(t) = taken {
+        t.forward.close().await;
+    }
+}
+
+/// Under the lock: invalidate a re-attach in flight and take the tunnel out.
+fn take(r: &mut Registry, project_id: &str) -> Option<LiveTunnel> {
+    r.pending.remove(project_id);
+    *r.generation.entry(project_id.to_string()).or_default() += 1;
+    let t = r.live.remove(project_id);
+    if let Some(ref t) = t {
+        r.stopped.remove(t.endpoint.base_url.as_str());
+    }
+    t
+}
+
+/// A start is about to attach itself: any background re-attach in flight
+/// is cancelled (it will hand its tunnel back and close it).
+pub fn cancel_reattach(project_id: &str) {
+    {
+        let mut r = lock();
+        r.pending.remove(project_id);
+        *r.generation.entry(project_id.to_string()).or_default() += 1;
+    }
+    notify();
+}
+
+/// A background re-attach that began at `generation` gave up: clear the
+/// pending flag, unless something newer has taken over since.
+pub fn end_reattach(project_id: &str, generation: u64) {
+    {
+        let mut r = lock();
+        if r.generation.get(project_id).copied().unwrap_or_default() == generation {
+            r.pending.remove(project_id);
+        }
+    }
+    notify();
+}
+
+/// Take the project's tunnel out and close it, and invalidate a background
+/// re-attach in flight.
+pub async fn close(project_id: &str) {
+    let taken = take(&mut lock(), project_id);
+    notify();
+    if let Some(t) = taken {
+        t.forward.close().await;
+    }
+}
+
+/// Close every tunnel, concurrently. The shutdown path's step.
+pub async fn close_all() {
+    let all: Vec<LiveTunnel> = {
+        let mut r = lock();
+        r.pending.clear();
+        r.stopped.clear();
+        for g in r.generation.values_mut() {
+            *g += 1;
+        }
+        r.live.drain().map(|(_, t)| t).collect()
+    };
+    notify();
+    futures_util::future::join_all(all.into_iter().map(|t| t.forward.close())).await;
+}
+
+/// The AWS watch saw the task behind target `target_id` STOPPED, for `why`.
+pub fn mark_stopped(target_id: &str, why: StopKind) {
+    lock().stopped.insert(target_id.to_string(), why);
+}
+
+/// Whether the AWS watch has confirmed the task behind `target_id` stopped.
+pub fn is_stopped(target_id: &str) -> bool {
+    lock().stopped.contains_key(target_id)
+}
+
+/// Why the task behind `target_id` stopped, once the watch has seen it.
+pub fn stop_kind(target_id: &str) -> Option<StopKind> {
+    lock().stopped.get(target_id).cloned()
+}
+
+pub fn is_pending(project_id: &str) -> bool {
+    lock().pending.contains(project_id)
+}
+
+/// The project's endpoint, waiting up to `timeout` while a background
+/// re-attach is still opening it. `None` when there is none.
+pub async fn wait_endpoint(project_id: &str, timeout: Duration) -> Option<AgentEndpoint> {
+    let mut rx = changed().subscribe();
+    let deadline = tokio::time::Instant::now() + timeout;
+    loop {
+        if let Some(ep) = get_endpoint(project_id) {
+            return Some(ep);
+        }
+        if !is_pending(project_id) {
+            return None;
+        }
+        if tokio::time::timeout_at(deadline, rx.changed()).await.is_err() {
+            return None;
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::Arc;
+
+    /// A stand-in tunnel that counts its closes.
+    pub(crate) struct FakeTunnel(pub Arc<AtomicUsize>);
+    impl TunnelHandle for FakeTunnel {
+        fn close(self: Box<Self>) -> BoxFuture<'static, ()> {
+            let n = self.0.clone();
+            Box::pin(async move {
+                n.fetch_add(1, Ordering::SeqCst);
+            })
+        }
+    }
+
+    pub(crate) fn fake_tunnel(port: u16, closes: Arc<AtomicUsize>) -> LiveTunnel {
+        LiveTunnel {
+            task: EcsTask {
+                cluster: "triple-c-dev".into(),
+                task_id: format!("t{port}"),
+                runtime_id: "r".into(),
+            },
+            task_arn: format!("arn:aws:ecs:eu-west-1:111122223333:task/triple-c-dev/t{port}"),
+            cluster_arn: "arn:aws:ecs:eu-west-1:111122223333:cluster/triple-c-dev".into(),
+            connection_id: "c1".into(),
+            region: "eu-west-1".into(),
+            sdk: SdkConfig::builder().build(),
+            forward: Box::new(FakeTunnel(closes)),
+            endpoint: AgentEndpoint::loopback(port, "tok"),
+            access_point_id: Some("fsap-1".into()),
+            task_definition_arn: "arn:td:1".into(),
+        }
+    }
+
+    fn pid(tag: &str) -> String {
+        format!("tunnels-test-{tag}-{}", uuid::Uuid::new_v4())
+    }
+
+    #[tokio::test]
+    async fn a_registered_tunnel_is_found_by_project_and_by_endpoint_and_closed_once() {
+        let closes = Arc::new(AtomicUsize::new(0));
+        let p = pid("reg");
+        assert!(get_endpoint(&p).is_none());
+        assert!(register(&p, fake_tunnel(61001, closes.clone())).is_none());
+        let ep = get_endpoint(&p).unwrap();
+        assert_eq!(ep, AgentEndpoint::loopback(61001, "tok"));
+        let (conn, region, _, arn) = task_of(&ep).unwrap();
+        assert_eq!((conn.as_str(), region.as_str()), ("c1", "eu-west-1"));
+        assert!(arn.ends_with("/t61001"));
+        assert_eq!(runtime(&p).unwrap().1.as_deref(), Some("fsap-1"));
+        close(&p).await;
+        close(&p).await;
+        assert_eq!(closes.load(Ordering::SeqCst), 1);
+        assert!(get_endpoint(&p).is_none() && task_of(&ep).is_none());
+    }
+
+    #[tokio::test]
+    async fn re_registering_hands_back_the_old_tunnel_and_clears_a_stale_stop() {
+        let closes = Arc::new(AtomicUsize::new(0));
+        let p = pid("rereg");
+        register(&p, fake_tunnel(61002, closes.clone()));
+        let id = AgentEndpoint::loopback(61003, "tok").base_url.to_string();
+        mark_stopped(&id, StopKind::Spot);
+        assert_eq!(stop_kind(&id), Some(StopKind::Spot));
+        let old = register(&p, fake_tunnel(61003, closes.clone())).unwrap();
+        assert_eq!(old.endpoint.base_url.port(), Some(61002));
+        assert!(!is_stopped(&id), "a new task on a reused port is not stopped");
+        old.forward.close().await;
+        close(&p).await;
+        assert_eq!(closes.load(Ordering::SeqCst), 2);
+    }
+
+    #[tokio::test]
+    async fn a_registering_tunnel_clears_a_stop_seen_under_the_projects_unattached_id() {
+        let p = pid("unattached-stale");
+        let placeholder = unattached_id(&p);
+        mark_stopped(&placeholder, StopKind::Spot);
+        let closes = Arc::new(AtomicUsize::new(0));
+        register(&p, fake_tunnel(61301, closes.clone()));
+        assert!(!is_stopped(&placeholder), "a later unattached spell must not read as stopped");
+        close(&p).await;
+
+        // A re-attach registering clears it too; and it can be forgotten directly.
+        let q = pid("unattached-stale-reattach");
+        mark_stopped(&unattached_id(&q), StopKind::Spot);
+        let g = begin_reattach(&q);
+        assert!(register_if_current(&q, g, fake_tunnel(61302, closes.clone())).is_ok());
+        assert!(!is_stopped(&unattached_id(&q)));
+        close(&q).await;
+        mark_stopped(&unattached_id(&q), StopKind::Idle);
+        forget_stopped(&unattached_id(&q));
+        assert!(!is_stopped(&unattached_id(&q)));
+    }
+
+    #[tokio::test]
+    async fn a_reattach_that_began_before_a_stop_does_not_register() {
+        let closes = Arc::new(AtomicUsize::new(0));
+        let p = pid("gen");
+        let g = begin_reattach(&p);
+        assert!(is_pending(&p));
+        close(&p).await; // the user stopped the project meanwhile
+        let back = register_if_current(&p, g, fake_tunnel(61005, closes.clone()));
+        let t = back.err().expect("handed back, not registered");
+        assert!(get_endpoint(&p).is_none() && !is_pending(&p));
+        t.forward.close().await;
+        assert_eq!(closes.load(Ordering::SeqCst), 1);
+
+        let g = begin_reattach(&p);
+        assert!(register_if_current(&p, g, fake_tunnel(61006, closes.clone())).is_ok());
+        assert!(get_endpoint(&p).is_some());
+        close(&p).await;
+    }
+
+    #[tokio::test]
+    async fn a_starts_tunnel_survives_a_reattach_that_finishes_after_it() {
+        let closes = Arc::new(AtomicUsize::new(0));
+        // Start cancels the pending re-attach, then registers its own.
+        let p = pid("start-wins");
+        let g = begin_reattach(&p);
+        cancel_reattach(&p);
+        assert!(!is_pending(&p));
+        register(&p, fake_tunnel(61010, closes.clone()));
+        let late = register_if_current(&p, g, fake_tunnel(61011, closes.clone()));
+        late.err().expect("the late re-attach is refused").forward.close().await;
+        assert_eq!(get_endpoint(&p).unwrap().base_url.port(), Some(61010), "Start's tunnel stays");
+        assert_eq!(closes.load(Ordering::SeqCst), 1, "only the late tunnel was closed");
+        // A stale end of that re-attach does not clear a newer one's pending flag.
+        let g2 = begin_reattach(&p);
+        end_reattach(&p, g);
+        assert!(is_pending(&p));
+        end_reattach(&p, g2);
+        assert!(!is_pending(&p));
+        close(&p).await;
+
+        // Even without a cancel, a plain register makes an older re-attach stale.
+        let p = pid("register-bumps");
+        let g = begin_reattach(&p);
+        register(&p, fake_tunnel(61012, closes.clone()));
+        assert!(register_if_current(&p, g, fake_tunnel(61013, closes.clone())).is_err());
+        assert_eq!(get_endpoint(&p).unwrap().base_url.port(), Some(61012));
+        close(&p).await;
+    }
+
+    #[tokio::test]
+    async fn a_death_report_closes_only_the_tunnel_of_the_task_that_died() {
+        let closes = Arc::new(AtomicUsize::new(0));
+        let p = pid("died");
+        register(&p, fake_tunnel(61007, closes.clone()));
+        close_if_task(&p, "arn:aws:ecs:eu-west-1:111122223333:task/triple-c-dev/older").await;
+        assert!(get_endpoint(&p).is_some(), "a newer task's tunnel stays");
+        close_if_task(&p, "arn:aws:ecs:eu-west-1:111122223333:task/triple-c-dev/t61007").await;
+        assert!(get_endpoint(&p).is_none());
+        assert_eq!(closes.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test]
+    async fn waiting_for_an_endpoint_ends_when_it_is_registered_or_the_reattach_gives_up() {
+        let p = pid("wait");
+        assert!(wait_endpoint(&p, Duration::from_secs(5)).await.is_none(), "nothing pending");
+        begin_reattach(&p);
+        let p2 = p.clone();
+        let waiter = tokio::spawn(async move { wait_endpoint(&p2, Duration::from_secs(5)).await });
+        tokio::time::sleep(Duration::from_millis(20)).await;
+        register(&p, fake_tunnel(61004, Arc::new(AtomicUsize::new(0))));
+        assert_eq!(waiter.await.unwrap().unwrap().base_url.port(), Some(61004));
+        close(&p).await;
+
+        let g = begin_reattach(&p);
+        let p2 = p.clone();
+        let waiter = tokio::spawn(async move { wait_endpoint(&p2, Duration::from_secs(5)).await });
+        tokio::time::sleep(Duration::from_millis(20)).await;
+        end_reattach(&p, g);
+        assert!(waiter.await.unwrap().is_none());
+    }
+}

app/src-tauri/src/host/watch.rs

@@ -0,0 +1,334 @@
+//! Where `container_watch` learns that a project container stopped on its
+//! own. Host-neutral shape: a reachability check, a stream of containers
+//! reported dead (replayable from a point in time), and a positive-exit check
+//! used to confirm each report before anything changes.
+//!
+//! Docker pushes `die` events. AWS has no push stream from the app's point of
+//! view; its [`ExitSource::deaths`] is a `DescribeTasks` poll (every 15 s) over
+//! the tasks of Running AWS projects that yields the stopped ones, which
+//! `container_watch` handles the same way because every report is confirmed
+//! with [`ContainerTarget::has_exited`] anyway.
+
+use std::collections::{HashMap, VecDeque};
+use std::sync::Arc;
+use std::time::Duration;
+
+use futures_util::future::BoxFuture;
+use futures_util::{Stream, StreamExt};
+use std::pin::Pin;
+
+use super::ContainerTarget;
+use crate::docker;
+
+/// How often the AWS watch asks ECS (spec, "Lifecycle and status").
+pub const AWS_POLL_INTERVAL: Duration = Duration::from_secs(15);
+
+/// Which host's deaths to watch.
+#[derive(Clone)]
+pub enum ExitSource {
+    Docker,
+    Aws(AwsWatch),
+}
+
+impl std::fmt::Debug for ExitSource {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ExitSource::Docker => f.write_str("Docker"),
+            ExitSource::Aws(w) => write!(f, "Aws(every {:?})", w.interval),
+        }
+    }
+}
+
+/// Where a task's DescribeTasks goes: the connection and region its
+/// credentials and endpoint come from, and the cluster.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct TaskGroup {
+    pub connection_id: String,
+    pub region: String,
+    pub cluster_arn: String,
+}
+
+/// A Running AWS project's task, and the target a death is reported as.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct WatchedTask {
+    pub target: ContainerTarget,
+    pub group: TaskGroup,
+    pub task_arn: String,
+}
+
+/// The project-to-task lookup the AWS watch runs on, injected so it can be
+/// faked (Task 6 backs it with the tunnel registry / project store and
+/// `aws::tasks::stopped_among`).
+pub trait AwsTaskLookup: Send + Sync {
+    /// The tasks of the projects that are Running now. Read on every poll.
+    fn running_tasks(&self) -> Vec<WatchedTask>;
+    /// Of `arns` (all in `group`, at most 100), the ones that are STOPPED or
+    /// gone. `Err` when ECS could not be asked.
+    fn stopped<'a>(
+        &'a self,
+        group: &'a TaskGroup,
+        arns: &'a [String],
+    ) -> BoxFuture<'a, Result<Vec<String>, String>>;
+}
+
+/// The AWS death poll: a lookup and how often to run it.
+#[derive(Clone)]
+pub struct AwsWatch {
+    lookup: Arc<dyn AwsTaskLookup>,
+    interval: Duration,
+}
+
+impl AwsWatch {
+    pub fn new(lookup: Arc<dyn AwsTaskLookup>) -> Self {
+        Self::every(lookup, AWS_POLL_INTERVAL)
+    }
+    pub fn every(lookup: Arc<dyn AwsTaskLookup>, interval: Duration) -> Self {
+        AwsWatch { lookup, interval }
+    }
+}
+
+/// DescribeTasks' batch limit.
+const DESCRIBE_BATCH: usize = 100;
+
+/// One poll: the targets of Running projects whose task stopped. Tasks are
+/// asked about per group (connection + region + cluster), 100 at a time. A
+/// group that can't be asked (expired SSO, network) is logged and skipped —
+/// it confirms nothing, and the other groups are still watched; the next
+/// poll asks again.
+pub async fn poll_stopped(lookup: &dyn AwsTaskLookup) -> Vec<ContainerTarget> {
+    let mut groups: HashMap<TaskGroup, Vec<WatchedTask>> = HashMap::new();
+    for t in lookup.running_tasks() {
+        groups.entry(t.group.clone()).or_default().push(t);
+    }
+    let mut dead = Vec::new();
+    for (group, tasks) in groups {
+        for chunk in tasks.chunks(DESCRIBE_BATCH) {
+            let arns: Vec<String> = chunk.iter().map(|t| t.task_arn.clone()).collect();
+            match lookup.stopped(&group, &arns).await {
+                Ok(stopped) => dead.extend(
+                    chunk
+                        .iter()
+                        .filter(|t| stopped.contains(&t.task_arn))
+                        .map(|t| t.target.clone()),
+                ),
+                Err(e) => log::warn!(
+                    "Container watch: could not check AWS tasks in {} ({}): {e}",
+                    group.region,
+                    group.cluster_arn
+                ),
+            }
+        }
+    }
+    dead
+}
+
+/// Polls forever, `interval` apart (the first after one interval: the
+/// watcher sweeps on connect), yielding each stopped task's target.
+fn aws_deaths(watch: AwsWatch) -> DeathStream {
+    Box::pin(futures_util::stream::unfold(
+        (watch, VecDeque::new()),
+        |(watch, mut queue)| async move {
+            loop {
+                if let Some(t) = queue.pop_front() {
+                    return Some((Ok(t), (watch, queue)));
+                }
+                tokio::time::sleep(watch.interval).await;
+                queue.extend(poll_stopped(&*watch.lookup).await);
+            }
+        },
+    ))
+}
+
+pub type DeathStream = Pin<Box<dyn Stream<Item = Result<ContainerTarget, String>> + Send>>;
+
+impl ExitSource {
+    /// Whether the host answers at all. A `false` here is a failed connection
+    /// attempt for the watcher's backoff.
+    pub async fn reachable(&self) -> bool {
+        match self {
+            ExitSource::Docker => docker::events::ping().await,
+            // No one endpoint to ping: each poll asks every group, and a
+            // group that fails is skipped rather than ending the stream.
+            ExitSource::Aws(_) => true,
+        }
+    }
+
+    /// Containers reported dead, replayed from `since` (unix seconds). An `Err`
+    /// item, or the stream ending, means the connection is gone.
+    pub fn deaths(&self, since: i64) -> DeathStream {
+        match self {
+            ExitSource::Docker => Box::pin(
+                docker::events::container_deaths(since).map(|r| r.map(ContainerTarget::docker)),
+            ),
+            // ECS has no replay: a task that stopped while the stream was
+            // down is still STOPPED (or gone) on the next poll.
+            ExitSource::Aws(watch) => aws_deaths(watch.clone()),
+        }
+    }
+}
+
+impl ContainerTarget {
+    /// `true` only when the host positively says the container is not running
+    /// (stopped, or gone). Any failure to find out is `false` — unlike
+    /// [`ContainerTarget::is_running`], whose callers want errors to read as
+    /// "not running".
+    pub async fn has_exited(&self) -> bool {
+        match self {
+            ContainerTarget::Docker { container_id } => docker::events::has_exited(container_id).await,
+            // The agent can only say "I answer" or "I don't"; silence is not a
+            // positive exit (an SSM blip looks the same). Only the host that
+            // runs the container can confirm a death: the AWS watch records
+            // the targets whose task ECS reports STOPPED in the tunnel
+            // registry (R3), and nothing else ever confirms one.
+            ContainerTarget::Agent(ep) => super::tunnels::is_stopped(ep.base_url.as_str()),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::Mutex;
+
+    fn group(conn: &str, region: &str) -> TaskGroup {
+        TaskGroup {
+            connection_id: conn.into(),
+            region: region.into(),
+            cluster_arn: format!("arn:aws:ecs:{region}:111122223333:cluster/triple-c-dev"),
+        }
+    }
+
+    fn task(n: usize, g: &TaskGroup) -> WatchedTask {
+        WatchedTask {
+            target: ContainerTarget::docker(format!("target-{:012}", n)),
+            group: g.clone(),
+            task_arn: format!("arn:aws:ecs:{}:111122223333:task/triple-c-dev/t{n}", g.region),
+        }
+    }
+
+    /// Running tasks are fixed; `dead` are the stopped ARNs; a group whose
+    /// region is `failing` errors. Every `stopped` call is recorded.
+    struct FakeLookup {
+        tasks: Mutex<Vec<WatchedTask>>,
+        dead: Vec<String>,
+        failing: &'static str,
+        asked: Mutex<Vec<(TaskGroup, usize)>>,
+        polls: Mutex<usize>,
+    }
+
+    impl FakeLookup {
+        fn new(tasks: Vec<WatchedTask>, dead: Vec<String>) -> Self {
+            FakeLookup {
+                tasks: Mutex::new(tasks),
+                dead,
+                failing: "",
+                asked: Mutex::new(Vec::new()),
+                polls: Mutex::new(0),
+            }
+        }
+    }
+
+    impl AwsTaskLookup for FakeLookup {
+        fn running_tasks(&self) -> Vec<WatchedTask> {
+            *self.polls.lock().unwrap() += 1;
+            self.tasks.lock().unwrap().clone()
+        }
+        fn stopped<'a>(
+            &'a self,
+            group: &'a TaskGroup,
+            arns: &'a [String],
+        ) -> BoxFuture<'a, Result<Vec<String>, String>> {
+            Box::pin(async move {
+                self.asked.lock().unwrap().push((group.clone(), arns.len()));
+                if group.region == self.failing {
+                    return Err("SSO session expired".into());
+                }
+                Ok(arns.iter().filter(|a| self.dead.contains(a)).cloned().collect())
+            })
+        }
+    }
+
+    #[tokio::test]
+    async fn a_poll_asks_each_group_once_and_reports_only_stopped_tasks() {
+        let (a, b) = (group("c1", "eu-west-1"), group("c2", "us-east-1"));
+        let tasks = vec![task(1, &a), task(2, &b), task(3, &a)];
+        let dead = vec![tasks[0].task_arn.clone(), tasks[1].task_arn.clone()];
+        let lookup = FakeLookup::new(tasks.clone(), dead);
+        let mut got = poll_stopped(&lookup).await;
+        got.sort_by(|x, y| x.id().cmp(y.id()));
+        assert_eq!(got, vec![tasks[0].target.clone(), tasks[1].target.clone()]);
+        let mut asked = lookup.asked.lock().unwrap().clone();
+        asked.sort_by(|x, y| x.0.region.cmp(&y.0.region));
+        assert_eq!(asked, vec![(a, 2), (b, 1)]);
+    }
+
+    #[tokio::test]
+    async fn a_group_that_cannot_be_asked_confirms_nothing_and_the_others_still_report() {
+        let (a, b) = (group("c1", "eu-west-1"), group("c2", "us-east-1"));
+        let tasks = vec![task(1, &a), task(2, &b)];
+        let dead = tasks.iter().map(|t| t.task_arn.clone()).collect();
+        let mut lookup = FakeLookup::new(tasks.clone(), dead);
+        lookup.failing = "eu-west-1";
+        assert_eq!(poll_stopped(&lookup).await, vec![tasks[1].target.clone()]);
+    }
+
+    #[tokio::test]
+    async fn tasks_are_described_a_hundred_at_a_time() {
+        let a = group("c1", "eu-west-1");
+        let lookup = FakeLookup::new((0..250).map(|n| task(n, &a)).collect(), Vec::new());
+        assert!(poll_stopped(&lookup).await.is_empty());
+        let sizes: Vec<usize> = lookup.asked.lock().unwrap().iter().map(|(_, n)| *n).collect();
+        assert_eq!(sizes, vec![100, 100, 50]);
+    }
+
+    #[tokio::test]
+    async fn no_running_aws_projects_means_no_aws_calls() {
+        let lookup = FakeLookup::new(Vec::new(), Vec::new());
+        assert!(poll_stopped(&lookup).await.is_empty());
+        assert!(lookup.asked.lock().unwrap().is_empty());
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn the_aws_stream_polls_every_interval_and_yields_each_death() {
+        let a = group("c1", "eu-west-1");
+        let tasks = vec![task(1, &a), task(2, &a)];
+        let lookup = Arc::new(FakeLookup::new(
+            tasks.clone(),
+            vec![tasks[0].task_arn.clone(), tasks[1].task_arn.clone()],
+        ));
+        let source = ExitSource::Aws(AwsWatch::new(lookup.clone()));
+        assert!(source.reachable().await);
+        let mut deaths = source.deaths(0);
+        let t0 = tokio::time::Instant::now();
+        let first = deaths.next().await.unwrap().unwrap();
+        assert_eq!(t0.elapsed(), AWS_POLL_INTERVAL, "the first poll waits one interval");
+        let second = deaths.next().await.unwrap().unwrap();
+        assert_eq!(t0.elapsed(), AWS_POLL_INTERVAL, "one poll, both reported");
+        let mut got = vec![first, second];
+        got.sort_by(|x, y| x.id().cmp(y.id()));
+        assert_eq!(got, vec![tasks[0].target.clone(), tasks[1].target.clone()]);
+        assert_eq!(*lookup.polls.lock().unwrap(), 1);
+
+        // Once the projects are no longer Running, polls go on and report nothing.
+        lookup.tasks.lock().unwrap().clear();
+        let quiet = tokio::time::timeout(AWS_POLL_INTERVAL * 3 + Duration::from_secs(1), deaths.next()).await;
+        assert!(quiet.is_err(), "nothing to report");
+        assert_eq!(*lookup.polls.lock().unwrap(), 4);
+    }
+
+    #[test]
+    fn the_aws_poll_runs_every_fifteen_seconds() {
+        assert_eq!(AWS_POLL_INTERVAL, Duration::from_secs(15));
+    }
+
+    #[tokio::test]
+    async fn an_agent_target_never_confirms_an_exit_on_its_own() {
+        // R3: Task 6 wires the tunnel registry into this arm.
+        let ep = crate::host::agent::AgentEndpoint::new(
+            url::Url::parse("http://127.0.0.1:47901").unwrap(),
+            "fake-token",
+        )
+        .unwrap();
+        assert!(!ContainerTarget::Agent(ep).has_exited().await);
+    }
+}

app/src-tauri/src/lib.rs

@@ -1,4 +1,5 @@
 mod auth_bridge;
+mod aws;
 mod browser_view;
 #[cfg(test)]
 mod command_census;
@@ -7,6 +8,7 @@ mod container_watch;
 #[cfg(target_os = "linux")]
 mod linux_media;
 mod docker;
+mod host;
 pub mod file_viewer;
 mod install_helper;
 mod logging;
@@ -22,7 +24,7 @@ use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
 use auth_bridge::AuthBridgeManager;
-use docker::exec::ExecSessionManager;
+use host::ExecSessionManager;
 use storage::projects_store::ProjectsStore;
 use storage::settings_store::SettingsStore;
 use tauri::async_runtime::JoinHandle;
@@ -209,6 +211,13 @@ where
     }
 }
 
+/// The detached OpenTofu runner (`aws::tofu`): `Some(exit code)` when this
+/// process was started as one, `None` for a normal launch. `main` asks
+/// before anything Tauri or GTK starts, so a runner never opens a window.
+pub fn tofu_runner_main() -> Option<i32> {
+    aws::tofu::runner_main(std::env::args_os())
+}
+
 pub fn run() {
     logging::init();
 
@@ -320,6 +329,20 @@ pub fn run() {
             lifecycle_setup.track(container_watch::spawn(
                 app.handle().clone(),
                 projects_store_setup.clone(),
+                crate::host::watch::ExitSource::Docker,
+                lifecycle_setup.cancellation(),
+            ));
+            // The same for AWS projects: a DescribeTasks poll every 15 s over
+            // the tasks of Running AWS projects (none: no AWS calls at all).
+            lifecycle_setup.track(container_watch::spawn(
+                app.handle().clone(),
+                projects_store_setup.clone(),
+                crate::host::watch::ExitSource::Aws(crate::host::watch::AwsWatch::new(
+                    std::sync::Arc::new(crate::host::aws_host::StoreTaskLookup {
+                        projects: projects_store_setup.clone(),
+                        settings: settings_store_setup.clone(),
+                    }),
+                )),
                 lifecycle_setup.cancellation(),
             ));
 
@@ -499,6 +522,9 @@ pub fn run() {
                             exec_manager.close_all_sessions(),
                             auth_bridge.stop_all(),
                             browser_view::manager().stop_all(),
+                            // Each AWS tunnel is a session-manager-plugin
+                            // child that `exit` would not end.
+                            crate::host::tunnels::close_all(),
                         );
                     };
 
@@ -525,8 +551,12 @@ pub fn run() {
             commands::project_commands::update_project,
             commands::project_commands::start_project_container,
             commands::project_commands::stop_project_container,
+            commands::project_commands::check_unsaved_work,
+            commands::project_commands::aws_task_log,
+            commands::project_commands::remove_aws_resources,
             commands::project_commands::rebuild_project_container,
             commands::project_commands::reconcile_project_statuses,
+            commands::project_commands::reconcile_aws_projects,
             // Notes
             commands::notes_commands::list_notes,
             commands::notes_commands::save_note,
@@ -592,6 +622,27 @@ pub fn run() {
             commands::settings_commands::detect_aws_config,
             commands::settings_commands::inspect_ca_cert_path,
             commands::settings_commands::list_aws_profiles,
+            // AWS host connections
+            commands::host_commands::add_aws_profile_connection,
+            commands::host_commands::add_aws_keys_connection,
+            commands::host_commands::update_aws_connection,
+            commands::host_commands::remove_host_connection,
+            commands::host_commands::aws_connection_identity,
+            commands::host_commands::aws_connection_sso_login,
+            commands::host_commands::check_aws_permissions,
+            commands::host_commands::aws_policy_document,
+            commands::environment_commands::detect_aws_environments,
+            commands::environment_commands::deploy_aws_environment,
+            commands::environment_commands::update_aws_environment,
+            commands::environment_commands::repair_aws_environment,
+            commands::environment_commands::destroy_incomplete_aws_environment,
+            commands::environment_commands::unlock_aws_state,
+            commands::environment_commands::follow_aws_deployment,
+            commands::environment_commands::cancel_aws_deployment,
+            commands::environment_commands::push_aws_saved_state,
+            commands::environment_commands::onboard_aws_user,
+            commands::environment_commands::deploy_aws_permissions_boundary,
+            commands::environment_commands::save_aws_admin_bundle,
             commands::settings_commands::detect_host_timezone,
             // Settings export/import
             commands::settings_export_commands::export_settings,